TI-2019-02740 Aliases CVE-2019-3721 GHSA-v279-g8wh-682w

Improper Range Header Processing Vulnerability

LOW 38CWE-770Published 2019-04-25 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-770.

Summary

Dell EMC Open Manage System Administrator (OMSA) versions prior to 9.3.0 contain an Improper Range Header Processing Vulnerability. A remote unauthenticated attacker may send crafted requests with overlapping ranges to cause the application to compress each of the requested bytes, resulting in a crash due to excessive memory consumption and preventing users from accessing the system.

Why it matters now

EPSS 0.02584 85th percentileScored 2026-11-07

Fix Fixed Open Manage System Administrator (Dell EMC): 9.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell EMC	Open Manage System Administrator	9.3 to before 9.3	9.3	Patch available	CNA

Open Manage System Administrator VendorDell EMC Affected 9.3 to before 9.3 Fixed in 9.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:dell:emc_openmanage_server_administrator::::::::	before 9.3.0	Vulnerable	Dell

cpe:2.3:a:dell:emc_openmanage_server_administrator:*:*:*:*:*:*:*:* Versions before 9.3.0 Vulnerable ·Dell

Remediation

Fix · CNA Open Manage System Administrator (Dell EMC) Fixed in 9.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2019-04-25
Dell EMC Open Manage System Administrator 9.3
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2019-02739 Directory traversal in Dell EMC Open Manage System AdministratorPriority LOW 29
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2019-3721
2026-10-03 Alias added: GHSA-v279-g8wh-682w

References

Advisory 1

https://www.dell.com/support/article/us/en/04/sln316915/dsa-2019-060-dell-emc-open-manage-system-administrator-multiple-vulnerabilities?lang=en

TI-2018-01128 Missing authorization in Dell EMC Avamar, Integrated Data Protection Appliance CVSS 3.0CRITICAL 9.8
TI-2018-01141 OS command injection in Dell EMC RecoverPoint CVSS 3.0CRITICAL 9.8
TI-2018-07852 Dell EMC Avamar and Integrated Data Protection Appliance Remote Code Execution Vulnerability CVSS 3.0CRITICAL 9.8
TI-2017-05620 EMC Networker Remote Code Execution Vulnerability CVSS 3.0CRITICAL 9.8
TI-2018-11243 Dell EMC ESRS Policy Manager versions 6.8 and prior contain a remote code execution… CVSS 3.0CRITICAL 9.8
TI-2017-08041 OS command injection in Dell EMC Data Protection Advisor CVSS 3.1HIGH 8.8

See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences