CVE-2022-45103: 
Dell EMC Solutions Enabler vulnerability analysis and mitigation

CVE-2022-45103 is an information disclosure vulnerability affecting Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x. The vulnerability was discovered in 2022 and publicly disclosed in January 2023 (NVD). The vulnerability stems from improper input validation in vApp Manager's Download Logs feature (Dell Advisory).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 MEDIUM with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The technical nature of the vulnerability involves improper input validation in the vApp Manager's Download Logs feature, which could allow authenticated users to read arbitrary files on the underlying file system (NVD).

The vulnerability allows a low privileged remote attacker to read arbitrary files on the underlying file system, potentially exposing sensitive information. This could lead to unauthorized access to system files and confidential data (Dell Advisory).

The vulnerability requires low attack complexity and can be exploited by a remote attacker with low privileges. No user interaction is required for exploitation. The attack vector is network-based, making it accessible to remote attackers (NVD).

Dell has released security updates to address this vulnerability. Users should upgrade to Unisphere for PowerMax version 9.2.3.22 or 10.0.0.5, Solutions Enabler version 9.2.3.6 or 10.0.0.5, and VASA Provider to version 9.2.4.22 (Dell Advisory).