{"containers": {"cna": {"affected": [{"product": "Data Protection Central", "vendor": "Dell", "versions": [{"status": "affected", "version": "1.0, 1.0.1, 18.1, 18.2, 19.1"}]}], "datePublic": "2019-09-04T00:00:00", "descriptions": [{"lang": "en", "value": "Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by obtaining a CA signed certificate from Data Protection Central to impersonate a valid system to compromise the integrity of data."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-296", "description": "CWE-296: Improper Following of a Certificate's Chain of Trust", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2020-03-18T18:20:16", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.dell.com/support/security/en-us/details/537007/DSA-2019-135-Dell-EMC-Data-Protection-Central-Improper-Chain-of-Trust-Vulnerability"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@dell.com", "DATE_PUBLIC": "2019-09-04", "ID": "CVE-2019-3762", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Data Protection Central", "version": {"version_data": [{"version_affected": "=", "version_value": "1.0, 1.0.1, 18.1, 18.2, 19.1"}]}}]}, "vendor_name": "Dell"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by obtaining a CA signed certificate from Data Protection Central to impersonate a valid system to compromise the integrity of data."}]}, "impact": {"cvss": {"baseScore": 7.5, "baseSeverity": "High", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-296: Improper Following of a Certificate's Chain of Trust"}]}]}, "references": {"reference_data": [{"name": "https://www.dell.com/support/security/en-us/details/537007/DSA-2019-135-Dell-EMC-Data-Protection-Central-Improper-Chain-of-Trust-Vulnerability", "refsource": "MISC", "url": "https://www.dell.com/support/security/en-us/details/537007/DSA-2019-135-Dell-EMC-Data-Protection-Central-Improper-Chain-of-Trust-Vulnerability"}]}}}}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2019-3762", "datePublished": "2019-09-04T00:00:00", "dateReserved": "2019-01-03T00:00:00", "dateUpdated": "2020-03-18T18:20:16", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:emc_data_protection_central:1.0:*:*:*:*:*:*:*", "matchCriteriaId": "9D08A9E4-6CBD-4FD5-8D95-5EF8836058EC", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:emc_data_protection_central:1.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "B67413B0-336F-4531-99D4-01785D18148F", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:emc_data_protection_central:18.1:*:*:*:*:*:*:*", "matchCriteriaId": "2146ECFF-AC16-4A9C-A7B2-5141E17CE4A3", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:emc_data_protection_central:18.2:*:*:*:*:*:*:*", "matchCriteriaId": "1B65A4C0-54B8-4686-A696-792E61E89899", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:emc_data_protection_central:19.1:*:*:*:*:*:*:*", "matchCriteriaId": "DC9A5CC1-F413-44AD-901B-899FE33B7B80", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "8C4D195D-C047-42E9-9885-0464642EC6EC", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.1:*:*:*:*:*:*:*", "matchCriteriaId": "76D6282D-ABA7-4972-8E13-2A625F13CF53", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.2:*:*:*:*:*:*:*", "matchCriteriaId": "06E2AD30-A9F5-453C-BC38-2A35DD39FA85", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.3:*:*:*:*:*:*:*", "matchCriteriaId": "2114A81D-44AB-444B-85D4-D3A713418267", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.4:*:*:*:*:*:*:*", "matchCriteriaId": "FB029291-8242-4BE2-B7E3-C1D33421FE8D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Data Protection Central versions 1.0, 1.0.1, 18.1, 18.2, and 19.1 contains an Improper Certificate Chain of Trust Vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability by obtaining a CA signed certificate from Data Protection Central to impersonate a valid system to compromise the integrity of data."}, {"lang": "es", "value": "Data Protection Central versiones 1.0, 1.0.1, 18.1, 18.2 y 19.1, contiene una vulnerabilidad de Cadena de Confianza de Certificado Inapropiada. atacante remoto no autenticado podr\u00eda explotar esta vulnerabilidad mediante la obtenci\u00f3n de un certificado firmado de CA de Data Protection Central al suplantar un sistema v\u00e1lido para comprometer la integridad de los datos."}], "id": "CVE-2019-3762", "lastModified": "2020-03-27T12:52:41.917", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security_alert@emc.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2020-03-18T19:15:17.437", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/security/en-us/details/537007/DSA-2019-135-Dell-EMC-Data-Protection-Central-Improper-Chain-of-Trust-Vulnerability"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-296"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}