CVE-2022-24414: Infoleak
Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attacks.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-24414?
CVE-2022-24414 is considered a high-severity vulnerability due to the potential exposure of sensitive auth tokens.
How do I fix CVE-2022-24414?
To fix CVE-2022-24414, ensure you are using Dell EMC CloudLink version 7.1.4 or later, which resolves the token exposure issue.
What impact does CVE-2022-24414 have on Dell EMC CloudLink?
CVE-2022-24414 may allow attackers to exploit exposed auth tokens, potentially gaining unauthorized access to the CloudLink server.
Is CVE-2022-24414 present in all versions of Dell EMC CloudLink?
Yes, CVE-2022-24414 affects Dell EMC CloudLink 7.1.3 and all earlier versions.
How can auth tokens be protected to mitigate CVE-2022-24414?
To mitigate CVE-2022-24414, avoid including auth tokens in GET request URLs to prevent logging in reverse proxies and server logs.