Read the docs
TI-2022-15271 Aliases CVE-2022-34372GHSA-4vx6-fgh9-hr42

Authentication bypass in Dell Cyber Recovery

Priority MEDIUM 45CWE-288Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-288.

Summary

Dell PowerProtect Cyber Recovery versions before 19.11.0.2 contain an authentication bypass vulnerability. A remote unauthenticated attacker may potentially access and interact with the docker registry API leading to an authentication bypass. The attacker may potentially alter the docker images leading to a loss of integrity and confidentiality

Why it matters now

EPSS 0.01268 69th percentileScored 2026-11-07
Fix Fixed Cyber Recovery (Dell): 19.11

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellCyber Recoverybefore 19.1119.11Patch availableCNA
  • Cyber Recovery VendorDell Affected before 19.11 Fixed in 19.11 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dell:powerprotect_cyber_recovery:*:*:*:*:*:*:*:*before 19.11.0.2VulnerableDell
  • cpe:2.3:a:dell:powerprotect_cyber_recovery:*:*:*:*:*:*:*:* Versions before 19.11.0.2 Vulnerable ·Dell

Remediation

  • Fix · CNA Cyber Recovery (Dell) Fixed in 19.11

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-34372
  2. 2026-10-03 Alias added: GHSA-4vx6-fgh9-hr42

References

Patch 1

  • TI-2023-15748 Dell Power Protect Cyber Recovery, contains an Authentication Bypass vulnerability. CVSS 3.1HIGH 8.8
  • TI-2026-55292 Improper authentication in Dell Power Protect Cyber Recovery CVSS 3.1HIGH 8.8
  • TI-2022-14123 Dell PowerProtect Cyber Recovery, versions prior to 19.11, contain a privilege escalation… CVSS 3.1HIGH 7.8
  • TI-2026-55293 Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link… CVSS 3.1HIGH 7.8
  • TI-2026-36716 SQL injection in Dell Power Protect Cyber Recovery CVSS 3.1MEDIUM 6.5
  • TI-2025-19300 Dell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of… CVSS 3.1MEDIUM 5.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences