ID CVE-2021-36326
Summary Dell EMC Streaming Data Platform, versions prior to 1.3 contain an SSL Strip Vulnerability in the User Interface (UI). A remote unauthenticated attacker could potentially exploit this vulnerability, leading to a downgrade in the communications between the client and server into an unencrypted format.
References
Vulnerable Configurations
  • cpe:2.3:a:dell:emc_streaming_data_platform:*:*:*:*:*:*:*:*
    cpe:2.3:a:dell:emc_streaming_data_platform:*:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 01-12-2021 - 14:07)
Impact:
Exploitability:
CWE CWE-757
CAPEC
  • Drop Encryption Level
    An attacker forces the encryption level to be lowered, thus enabling a successful attack against the encrypted data.
  • Weakening of Cellular Encryption
    An attacker, with control of a Cellular Rogue Base Station or through cooperation with a Malicious Mobile Network Operator can force the mobile device (e.g., the retransmission device) to use no encryption (A5/0 mode) or to use easily breakable encryption (A5/1 or A5/2 mode).
  • Client-Server Protocol Manipulation
    An adversary takes advantage of weaknesses in the protocol by which a client and server are communicating to perform unexpected actions. Communication protocols are necessary to transfer messages between client and server applications. Moreover, different protocols may be used for different types of interactions. For example, an authentication protocol might be used to establish the identities of the server and client while a separate messaging protocol might be used to exchange data. If there is a weakness in a protocol used by the client and server, an attacker might take advantage of this to perform various types of attacks. For example, if the attacker is able to manipulate an authentication protocol, the attacker may be able spoof other clients or servers. If the attacker is able to manipulate a messaging protocol, the may be able to read sensitive information or modify message contents. This attack is often made easier by the fact that many clients and servers support multiple protocols to perform similar roles. For example, a server might support several different authentication protocols in order to support a wide range of clients, including legacy clients. Some of the older protocols may have vulnerabilities that allow an attacker to manipulate client-server interactions.
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:M/Au:N/C:P/I:N/A:N
Last major update 01-12-2021 - 14:07
Published 30-11-2021 - 21:15
Last modified 01-12-2021 - 14:07
Back to Top