Product:
PowerProtect Data Domain
Summary
Dell PowerProtect Data Domain with Data Domain Operating System contains a Path Traversal vulnerability in the UI. An unauthenticated attacker with remote access could exploit this vulnerability, leading to information exposure. This affects multiple feature release versions and LTS releases.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.3 | CVE-2025-43889 |
Exploitation
To exploit this vulnerability, an attacker would need remote access to the affected system. By manipulating the pathname in requests to the UI, the attacker could gain access to restricted directories, potentially exposing sensitive information without needing authentication.
Affected Products
- Feature Release versions 7.7.1.0 through 8.4
- LTS2024 release Versions 7.13.1.0 through 7.13.1.30
- LTS 2023 release versions 7.10.1.0 through 7.10.1.60
Mitigation
To mitigate this vulnerability, users should apply the latest security updates provided by Dell. It is also recommended to restrict remote access to the affected systems and monitor for any unauthorized access attempts.