Detections
Analytics
Dell Wyse Management Suite < 3.2 Multiple Vulnerabilities (DSA-2021-070)
medium Nessus Plugin ID 148360
Language:
Synopsis
The version of Dell Wyse Management Suite installed on the remote Windows host is affected by a multiple vulnerabilities.Description
The version of Dell Wyse Management Suite installed on the remote Windows host is prior to 3.2. It is, therefore, affected by multiple vulnerabilities, including the following:- Incorrect validation of user input in the role name parser may lead to use of uninitialized memory allowing an unauthenticated attacker to use a specially crafted request to cause a denial of service.
This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.0-rc12; v4.2 versions prior to 4.2.9. (CVE-2020-7925)
- A user authorized to perform database queries may trigger a denial of service condition by issuing specially crafted queries which trigger an invariant in the IndexBoundsBuilder. This issue affects: MongoDB Inc. MongoDB Server v4.2 versions prior to 4.2.2 as used in Dell Wyse Management Suite. (CVE-2019-20924)
- A user authorized to perform database queries may trigger a denial of service condition by issuing specially crafted queries, which use the $mod operator to overflow negative values. This issue affects: MongoDB Inc. MongoDB Server v4.4 versions prior to 4.4.1; v4.2 versions prior to 4.2.9; v4.0 versions prior to 4.0.20; v3.6 versions prior to 3.6.20 as used in Dell Wyse Management Suite. (CVE-2019-2392)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Dell Wyse Management Suite 3.2 or later.See Also
Plugin Details
Severity: Medium
ID: 148360
File Name: dell_wyse_management_suite_dsa-2021-070.nasl
Version: 1.4
Type: local
Agent: windows
Family: Windows
Published: 4/7/2021
Updated: 8/3/2023
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Medium
Base Score: 4
Temporal Score: 3
Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:N/A:N
CVSS Score Source: CVE-2020-7928
CVSS v3
Risk Factor: Medium
Base Score: 6.5
Temporal Score: 5.7
Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:dell:wyse_management_suite
Required KB Items: installed_sw/Dell Wyse Management Suite
Exploit Ease: No known exploits are available
Patch Publication Date: 3/31/2021
Vulnerability Publication Date: 3/31/2021
Reference Information
CVE: CVE-2019-20924, CVE-2019-2392, CVE-2020-7921, CVE-2020-7923, CVE-2020-7925, CVE-2020-7928, CVE-2021-21533
IAVB: 2021-B-0024-S