Dell Storage Manager vulnerabilities

Dell Storage Manager version 20.1.21 contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass. Authentication Bypass in DSM Data Collector allows access to APIs exposed by ApiProxy.war in DataCollectorEar.ear using a special SessionKey and UserId.

The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 is protected using a hard-coded password. A remote user with knowledge of the password might potentially disable the SMI-S service via HTTP requests, affecting storage management and monitoring functionality via the SMI-S interface.

Dell Storage Center - Dell Storage Manager, version(s) DSM 20.1.21, contain(s) a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

Dell Storage Manager version 20.1.20 contains an improper restriction of XML External Entity Reference vulnerability. A low privileged attacker with remote access could exploit it, leading to unauthorized access.