Product:
Dell Storage Manager
Summary
Dell Storage Manager contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass. This allows access to APIs exposed by ApiProxy.war in DataCollectorEar.ear using a special SessionKey and UserId.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.8 | CVE-2025-43995 |
Exploitation
To exploit this vulnerability, an attacker must have remote access and use a specially crafted SessionKey and UserId to bypass authentication mechanisms. This allows the attacker to access sensitive APIs without proper authorization, potentially leading to unauthorized actions within the system.
Affected Products
- Dell Storage Manager – Version 20.1.21 is affected by an improper authentication vulnerability that allows unauthenticated remote access.
Mitigation
To mitigate this vulnerability, it is recommended to update to the latest version of Dell Storage Manager that addresses the authentication issues. Additionally, restricting remote access and monitoring API usage can help reduce the risk of exploitation.