TI-2024-35207 Aliases CVE-2024-52538 GHSA-9w69-fw68-48cq

SQL injection in Dell Avamar

LOW 38CWE-89Published 2024-12-10 · Updated 2025-08-04

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

Dell Avamar, versions prior to 19.12 with patch 338905, excluding 19.10 and 19.10SP1 with patch 338869, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00442 38th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell	Avamar	19.4; 19.7; 19.8; 19.9; 19.10; 19.10SP1	—	No fix listed	CNA

Avamar VendorDell Affected 19.4; 19.7; 19.8; 19.9; 19.10; 19.10SP1 Fixed in — No fix listed CNA

CPE configurations NVD · 8

CPE	Versions	Role	Vendor
cpe:2.3:a:dell:avamar_server:19.4:::::::*	19.4	Vulnerable	Dell
cpe:2.3:a:dell:avamar_server:19.7:::::::*	19.7	Vulnerable	Dell
cpe:2.3:a:dell:avamar_server:19.8:::::::*	19.8	Vulnerable	Dell
cpe:2.3:a:dell:avamar_server:19.9:::::::*	19.9	Vulnerable	Dell
cpe:2.3:a:dell:avamar_server:19.10:-::::::	19.10	Vulnerable	Dell
cpe:2.3:a:dell:avamar_server:19.10:sp1::::::	19.10 sp1	Vulnerable	Dell
cpe:2.3:h:dell:avamar_data_store:gen4t:::::::*	gen4t	Running on	Dell
cpe:2.3:h:dell:avamar_data_store:gen5a:::::::*	gen5a	Running on	Dell

cpe:2.3:a:dell:avamar_server:19.4:*:*:*:*:*:*:* Versions 19.4 Vulnerable ·Dell
cpe:2.3:a:dell:avamar_server:19.7:*:*:*:*:*:*:* Versions 19.7 Vulnerable ·Dell
cpe:2.3:a:dell:avamar_server:19.8:*:*:*:*:*:*:* Versions 19.8 Vulnerable ·Dell
cpe:2.3:a:dell:avamar_server:19.9:*:*:*:*:*:*:* Versions 19.9 Vulnerable ·Dell
cpe:2.3:a:dell:avamar_server:19.10:-:*:*:*:*:*:* Versions 19.10 Vulnerable ·Dell
cpe:2.3:a:dell:avamar_server:19.10:sp1:*:*:*:*:*:* Versions 19.10 sp1 Vulnerable ·Dell
cpe:2.3:h:dell:avamar_data_store:gen4t:*:*:*:*:*:*:* Versions gen4t Running on ·Dell
cpe:2.3:h:dell:avamar_data_store:gen5a:*:*:*:*:*:*:* Versions gen5a Running on ·Dell

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2024-12-10
Dell Avamar — dell.com/support/kbdoc/en-us/000258636/dsa-2024-489-securit…
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2024-31782 SQL injection in Dell AvamarPriority MEDIUM 49
- TI-2024-32209 SQL injection in Dell AvamarPriority LOW 39
Show all 3 records → Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-52538
2026-10-03 Alias added: GHSA-9w69-fw68-48cq

References

Advisory 1

https://www.dell.com/support/kbdoc/en-us/000258636/dsa-2024-489-security-update-for-dell-avamar-and-dell-avamar-virtual-edition-security-update-for-multiple-vulnerabilities

TI-2024-31782 SQL injection in Dell Avamar CVSS 3.1CRITICAL 9.8
TI-2024-32209 SQL injection in Dell Avamar CVSS 3.1HIGH 8.8
TI-2025-15106 Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the… CVSS 3.1MEDIUM 6.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences