CVE-2024-28977: 
Dell Repository Manager vulnerability analysis and mitigation

CVE-2024-28977 is a Path Traversal vulnerability discovered in Dell Repository Manager versions 3.4.2 through 3.4.4, specifically affecting the logger module. The vulnerability was disclosed on April 24, 2024. The affected software is Dell Repository Manager, a tool used for managing system updates and drivers (Dell Advisory).

The vulnerability exists in the logger module of Dell Repository Manager. It has been assigned a CVSS v3.1 base score of 3.3 (Low) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) by NIST, though Dell initially categorized it as CWE-20 (Improper Input Validation) (NVD).

When exploited, this vulnerability allows a local attacker with low privileges to gain unauthorized read access to files stored on the server filesystem. The access level is limited to the privileges of the running web application (Dell Advisory).

The vulnerability requires local access and low privileges to exploit. No known exploits in the wild have been reported at this time (NVD).

Dell has released version 3.4.5 of the Repository Manager to address this vulnerability. As a workaround, Dell recommends making changes in Install Anywhere to prevent adding encrypted passwords to log files. Users are advised to upgrade to the remediated version 3.4.5 (Dell Advisory).