Read the docs
TI-2024-19166 Aliases CVE-2024-28976GHSA-wc97-g5fc-9p6c

Improper input validation in Dell Repository Manager

Priority MEDIUM 40CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Dell Repository Manager, versions prior to 3.4.5, contains a Path Traversal vulnerability in API module. A local attacker with low privileges could potentially exploit this vulnerability to gain unauthorized write access to the files stored on the server filesystem with the privileges of the running web application.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00245 15th percentileScored 2026-11-07
Fix Fixed Dell Repository Manager (DRM) (Dell): 3.4.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellDell Repository Manager (DRM) N/A to before 3.4.53.4.5Patch availableCNA
  • Dell Repository Manager (DRM) VendorDell Affected N/A to before 3.4.5 Fixed in 3.4.5 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dell:repository_manager:*:*:*:*:*:*:*:*before 3.4.5VulnerableDell
  • cpe:2.3:a:dell:repository_manager:*:*:*:*:*:*:*:* Versions before 3.4.5 Vulnerable ·Dell

Remediation

  • Fix · CNA Dell Repository Manager (DRM) (Dell) Fixed in 3.4.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-28976
  2. 2026-10-03 Alias added: GHSA-wc97-g5fc-9p6c

References

Advisory 1

  • TI-2024-19167 Improper input validation in Dell Repository Manager CVSS 3.1MEDIUM 5.5
  • TI-2026-17305 Uncontrolled search path in Dell Repository Manager CVSS 3.1HIGH 7.8
  • TI-2025-28767 Dell Repository Manager (DRM), versions 3.4.7 and 3.4.8, contains an Improper Handling of… CVSS 3.1HIGH 7.8
  • TI-2023-23813 Improper access control in Dell Repository Manager CVSS 3.1HIGH 7.8
  • TI-2023-23804 Improper access control in Dell Repository Manager CVSS 3.1HIGH 7.8
  • TI-2023-08771 Improper privilege management in Dell Repository Manager CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences