High severity · published Aug 21, 2024
CVE-2023-22576
Dell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module
7.8
CVSS
0.1%
EPSS
No
On KEV
Description
Dell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module. A local low privileged attacker may potentially exploit this vulnerability leading to the execution of arbitrary executable on the operating system with high privileges using the existing vulnerability in operating system. Exploitation may lead to unavailability of the service.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RM
Repository Manager · Dell
before 3.4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-22576
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-22576
Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000207513/dsa-2023-017-dell-emc-repository-manager-drm-security-update-for-an-improper-privilege-management-vulnerability
More from Repository Manager
8.5
CVE-2026-86359
Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability
7.8
CVE-2026-21420
Dell Repository Manager (DRM), versions prior to 3.4.8, contains an Uncontrolled Search Path Element vulnerability
7.8
CVE-2025-45376
Dell Repository Manager (DRM), versions 3.4.7 and 3.4.8, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability
7.8
CVE-2024-28976
Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module
7.8
CVE-2023-44292
Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module