High severity · published Apr 24, 2024
CVE-2024-28976
Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module
7.8
CVSS
0.2%
EPSS
No
On KEV
Description
Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. A local attacker with low privileges could potentially exploit this vulnerability to gain unauthorized write access to the files stored on the server filesystem with the privileges of the running web application.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RM
Repository Manager · Dell
before 3.4.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-28976
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-28976
Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000224412/dsa-2024-189-security-update-for-dell-repository
More from Repository Manager
8.5
CVE-2026-86359
Dell Repository Manager, versions prior to 3.5.2, contains an Incorrect Default Permissions vulnerability
7.8
CVE-2026-21420
Dell Repository Manager (DRM), versions prior to 3.4.8, contains an Uncontrolled Search Path Element vulnerability
7.8
CVE-2025-45376
Dell Repository Manager (DRM), versions 3.4.7 and 3.4.8, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability
7.8
CVE-2023-22576
Dell Repository Manager version 3.4.2 and earlier, contain a Local Privilege Escalation Vulnerability in Installation module
7.8
CVE-2023-44292
Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module