CVE-2024-38490

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

Dell iDRAC Service Module version 5.3.0.0 and prior, contain a Out of bound Write Vulnerability. A privileged local attacker could execute arbitrary code potentially resulting in a denial of service event.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Dell	iDRAC Service Module (iSM)	>= N/A, <= 5.3.0.0
dell	emc_idrac_service_module	<= 5.3.0.0

References

https://www.dell.com/support/kbdoc/en-us/000227444/dsa-2024-086-security-update-for-dell-idrac-service-module-for-memory-corruption-vulnerabilitiesVendor Advisory

Timeline

Published: Aug 1, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-384918.4The vulnerability allows an unauthenticated attacker to read arbitrary information from the database.CVE-2024-384929.4This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected PAM system by uploading a speciall CVE-2024-384936.1A reflected cross-site scripting (XSS) vulnerability exists in the PAM UI web interface. A remote attacker able to convince a PAM user to cl CVE-2024-384948.6This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by sending CVE-2024-384955.3A specific authentication strategy allows a malicious attacker to learn ids of all PAM users defined in its database.CVE-2024-384965.1The vulnerability allows a malicious low-privileged PAM user to access information about other PAM users and their group memberships.CVE-2024-384998.8CA Client Automation (ITCM) allows non-admin/non-root users to encrypt a string using CAF CLI and SD_ACMD CLI. This would allow the non admi CVE-2024-38505.4Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on CVE-2024-385016.1An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-pri CVE-2024-385027.1An unauthenticated remote attacker may use stored XSS vulnerability to obtain information from a user or reboot the affected device once.CVE-2024-385035.4When editing a user, group or any object in the Syncope Console, HTML tags could be added to any text field and could lead to potential expl CVE-2024-385045.3In JetBrains YouTrack before 2024.2.34646 the Guest User Account was enabled for attaching files to articles