CVE-2021-36317

low-risk
Published 2021-12-21

Dell EMC Avamar Server version 19.4 contains a plain-text password storage vulnerability in AvInstaller. A local attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.

Do I need to act?

-
0.04% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
6
CVSS 6.7/10 Medium
LOCAL / LOW complexity

Affected Products (2)

Emc Powerprotect Data Protection Appliance

Affected Vendors

Dell

References (4)

Third Party Advisory https://security.gentoo.org/glsa/202210-09
Patch https://www.dell.com/support/kbdoc/000193369
Third Party Advisory https://security.gentoo.org/glsa/202210-09
Patch https://www.dell.com/support/kbdoc/000193369
28
/ 100
low-risk
Severity 21/34 · High
Exploitability 0/34 · Minimal
Exposure 7/34 · Low