Medium severity · published Dec 21, 2021
CVE-2021-36317
Dell EMC Avamar Server version 19.4 contains a plain-text password storage vulnerability in AvInstaller
6.7
CVSS
0.2%
EPSS
No
On KEV
Description
Dell EMC Avamar Server version 19.4 contains a plain-text password storage vulnerability in AvInstaller. A local attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AV
Avamar · Dell
19.4 · source: vendor
EA
Emc Avamar Server · Dell
19.4 · source: NVD
EP
Emc Powerprotect Data Protection Appliance · Dell
2.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-36317
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-36317
Third Party Advisory
https://security.gentoo.org/glsa/202210-09
Patch
https://www.dell.com/support/kbdoc/000193369
More from Avamar
10.0
CVE-2020-29495
DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer
9.8
CVE-2024-47484
Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements used in an SQL…
9.8
CVE-2020-29493
DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a SQL Injection Vulnerability in Fitness Analyzer
8.8
CVE-2024-47977
Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements used in an SQL…
8.8
CVE-2024-52538
Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements used in an SQL…
