Stanisław Koza

**Name of the Vulnerable Software and Affected Versions** Dell PowerProtect DD versions prior to 7.13.0.10 Dell PowerProtect DD LTS versions prior to 7.7.5.25 Dell PowerProtect DD LTS versions prior to 7.10.1.15 Dell PowerProtect DD version 6.2.1.110 **Description** The issue concerns an OS command injection vulnerability in the CLI of Dell PowerProtect DD. A local low-privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system takeover by an attacker. **Recommendations** For versions prior to 7.13.0.10, update to version 7.13.0.10 or later. For LTS versions prior to 7.7.5.25, update to version 7.7.5.25 or later. For LTS versions prior to 7.10.1.15, update to version 7.10.1.15 or later. For version 6.2.1.110, update to a version later than 6.2.1.110. As a temporary workaround, consider restricting access to the CLI to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Dell PowerProtect DD versions prior to 7.13.0.10 Dell PowerProtect DD LTS versions prior to 7.7.5.25 Dell PowerProtect DD LTS versions prior to 7.10.1.15 Dell PowerProtect DD version 6.2.1.110 **Description** The issue is related to an improper access control vulnerability. A local malicious user with low privileges could potentially exploit this vulnerability, leading to escalation of privilege. **Recommendations** For versions prior to 7.13.0.10, update to version 7.13.0.10 or later. For LTS versions prior to 7.7.5.25, update to version 7.7.5.25 or later. For LTS versions prior to 7.10.1.15, update to version 7.10.1.15 or later. For version 6.2.1.110, update to a version later than 6.2.1.110.

**Name of the Vulnerable Software and Affected Versions** Dell PowerProtect DD versions prior to 7.13.0.10 Dell PowerProtect DD LTS 7.7.5.25 Dell PowerProtect DD LTS 7.10.1.15 Dell PowerProtect DD version 6.2.1.110 **Description** A remote unauthenticated attacker could potentially exploit a DOM-based Cross-Site Scripting vulnerability, leading to the injection of malicious HTML or JavaScript code to a victim user's DOM environment in the browser. Exploitation may lead to information disclosure, session theft, or client-side request forgery. This vulnerability allows for full account takeover using the DataDomain REST API. **Recommendations** For versions prior to 7.13.0.10, update to version 7.13.0.10 or later. For LTS 7.7.5.25, update to a version later than 7.7.5.25. For LTS 7.10.1.15, update to a version later than 7.10.1.15. For version 6.2.1.110, update to a version later than 6.2.1.110. As a temporary workaround, consider restricting access to the DataDomain REST API until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Dell PowerProtect DD versions prior to 7.13.0.10 Dell PowerProtect DD version 6.2.1.110 Dell PowerProtect DD LTS versions prior to 7.7.5.25 Dell PowerProtect DD LTS versions prior to 7.10.1.15 **Description** The issue is related to an SQL Injection vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database, causing unauthorized read access to application data. This is due to a lack of protection of the SQL query structure. **Recommendations** For versions prior to 7.13.0.10, update to version 7.13.0.10 or later. For version 6.2.1.110, update to a version later than 6.2.1.110. For LTS versions prior to 7.7.5.25, update to version 7.7.5.25 or later. For LTS versions prior to 7.10.1.15, update to version 7.10.1.15 or later.