Dell Storage Manager Improper Authentication Vulnerability Allowing API Access

An improper authentication vulnerability has been identified in Dell Storage Manager, specifically in the Dell Storage Center product version 20.1.21. This vulnerability allows an unauthenticated remote attacker to bypass authentication mechanisms and access APIs exposed by ApiProxy.war in the Data Collector component. The exploitation involves using a special SessionKey and UserId, with the latter being associated with specific users created for particular purposes.

Impact

Exploitation of this vulnerability leads to an authentication bypass, allowing unauthorized access to sensitive APIs.

Remediation

Users are advised to update to Dell Storage Manager version 2020 R1.21 or later. Instructions for downloading the update are available on the Dell Support website.