Read the docs
TI-2019-13450 Aliases CVE-2019-18581GHSA-3cg8-9wqp-7hg9

Missing authorization in Dell Data Protection Advisor

Priority LOW 38CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-862.

Summary

Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server missing authorization vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this vulnerability to alter the application’s allowable list of OS commands. This may lead to arbitrary OS command execution as the regular user runs the DPA service on the affected system.

Why it matters now

EPSS 0.03919 90th percentileScored 2026-11-07
Fix Fixed Data Protection Advisor (Dell): 6.3, 6.4, 6.5 and version prior to 18.2 patch 83 and prior to 19.1 patch 71

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellData Protection Advisorbefore 6.3, 6.4, 6.5 and version prior to 18.2 patch 83 and prior to 19.1 patch 716.3, 6.4, 6.5 and version prior to 18.2 patch 83 and prior to 19.1 patch 71Patch availableCNA
  • Data Protection Advisor VendorDell Affected before 6.3, 6.4, 6.5 and version prior to 18.2 patch 83 and prior to 19.1 patch 71 Fixed in 6.3, 6.4, 6.5 and version prior to 18.2 patch 83 and prior to 19.1 patch 71 Patch available CNA

CPE configurations NVD · 15

CPEVersionsRoleVendor
cpe:2.3:a:dell:emc_data_protection_advisor:6.3:*:*:*:*:*:*:*6.3VulnerableDell
cpe:2.3:a:dell:emc_data_protection_advisor:6.4:*:*:*:*:*:*:*6.4VulnerableDell
cpe:2.3:a:dell:emc_data_protection_advisor:6.5:*:*:*:*:*:*:*6.5VulnerableDell
cpe:2.3:a:dell:emc_data_protection_advisor:18.1:*:*:*:*:*:*:*18.1VulnerableDell
cpe:2.3:a:dell:emc_data_protection_advisor:18.2:-:*:*:*:*:*:*18.2VulnerableDell
cpe:2.3:a:dell:emc_data_protection_advisor:19.1:-:*:*:*:*:*:*19.1VulnerableDell
cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.0:*:*:*:*:*:*:*2.0VulnerableDell
cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.1:*:*:*:*:*:*:*2.1VulnerableDell
cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.2:*:*:*:*:*:*:*2.2VulnerableDell
cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.3:*:*:*:*:*:*:*2.3VulnerableDell
  • cpe:2.3:a:dell:emc_data_protection_advisor:6.3:*:*:*:*:*:*:* Versions 6.3 Vulnerable ·Dell
  • cpe:2.3:a:dell:emc_data_protection_advisor:6.4:*:*:*:*:*:*:* Versions 6.4 Vulnerable ·Dell
  • cpe:2.3:a:dell:emc_data_protection_advisor:6.5:*:*:*:*:*:*:* Versions 6.5 Vulnerable ·Dell
  • cpe:2.3:a:dell:emc_data_protection_advisor:18.1:*:*:*:*:*:*:* Versions 18.1 Vulnerable ·Dell
  • cpe:2.3:a:dell:emc_data_protection_advisor:18.2:-:*:*:*:*:*:* Versions 18.2 Vulnerable ·Dell
  • cpe:2.3:a:dell:emc_data_protection_advisor:19.1:-:*:*:*:*:*:* Versions 19.1 Vulnerable ·Dell
  • cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·Dell
  • cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Dell
  • cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·Dell
  • cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.3:*:*:*:*:*:*:* Versions 2.3 Vulnerable ·Dell
Show 5 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.4:*:*:*:*:*:*:*2.4VulnerableDell
cpe:2.3:h:dell:emc_idpa_dp4400:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:h:dell:emc_idpa_dp5800:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:h:dell:emc_idpa_dp8300:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
cpe:2.3:h:dell:emc_idpa_dp8800:-:*:*:*:*:*:*:*not specified by NVDRunning onDell
  • cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.4:*:*:*:*:*:*:* Versions 2.4 Vulnerable ·Dell
  • cpe:2.3:h:dell:emc_idpa_dp4400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:h:dell:emc_idpa_dp5800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:h:dell:emc_idpa_dp8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell
  • cpe:2.3:h:dell:emc_idpa_dp8800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell

Remediation

  • Fix · CNA Data Protection Advisor (Dell) Fixed in 6.3, 6.4, 6.5 and version prior to 18.2 patch 83 and prior to 19.1 patch 71

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell Data Protection Advisor 6.3, 6.4, 6.5 and version prior to 18.2 patch 83 and prior to 19.1 patch 71

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2019-13451 Code injection in Dell Data Protection AdvisorPriority LOW 39
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-18581
  2. 2026-10-03 Alias added: GHSA-3cg8-9wqp-7hg9

References

Advisory 1

  • TI-2020-04404 OS command injection in Dell Data Protection Advisor CVSS 3.1HIGH 8.8
  • TI-2019-13451 Code injection in Dell Data Protection Advisor CVSS 3.1HIGH 7.2
  • TI-2018-07834 XML external entity injection in Dell EMC Data Protection Advisor CVSS 3.1HIGH 8.1
  • TI-2016-06764 Path traversal in EMC Data Protection Advisor EMC Data Protection Advisor 6.1.x, EMC Data… CVSS 3.1HIGH 7.5
  • TI-2020-04403 Dell EMC Data Protection Advisor versions 6.4, 6.5 and 18.1 contain an undocumented… CVSS 3.1HIGH 7.5
  • TI-2022-14939 Cross-site scripting in Dell Data Protection Advisor CVSS 3.1MEDIUM 5.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences