High severity · published Apr 18, 2019
CVE-2019-3718
Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability
8.8
CVSS
0.7%
EPSS
No
On KEV
Description
Dell SupportAssist Client versions prior to 3.2.0.90 contain an improper origin validation vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability to attempt CSRF attacks on users of the impacted systems.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SU
Supportassist · Dell
before 3.2.0.90 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3718
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3718
Broken Link
http://www.securityfocus.com/bid/108020
Vendor Advisory
https://www.dell.com/support/article/us/en/19/sln316857/dsa-2019-051-dell-supportassist-client-multiple-vulnerabilities?lang=en
More from Supportassist
8.0
CVE-2019-3719
Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability
7.8
CVE-2022-34387
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain a privilege escalation vulnerability
7.1
CVE-2022-34388
Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain information disclosure vulnerability
5.5
CVE-2022-34392
SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability
5.3
CVE-2022-34389
Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component