Vulnerabilities > CVE-2020-29505 - Insufficient Entropy vulnerability in multiple products

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

network

low complexity

dell

oracle

CWE-331

NVD

Published: 2022-07-11

Updated: 2022-10-28

Summary

Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Key Management Error Vulnerability.

Vulnerable Configurations

Part	Description	Count
Application	Dell Dell Bsafe Micro Edition Suite 3.1 Dell Bsafe Micro Edition Suite 3.2.0 Dell Bsafe Micro Edition Suite 3.2.1 Dell Bsafe Micro Edition Suite 3.2.2 Dell Bsafe Micro Edition Suite 3.2.3 Dell Bsafe Micro Edition Suite 3.2.4 Dell Bsafe Micro Edition Suite 3.2.5 Dell Bsafe Micro Edition Suite 3.2.6 Dell Bsafe Micro Edition Suite 4.0.0 Dell Bsafe Micro Edition Suite 4.0.1 Dell Bsafe Micro Edition Suite 4.0.2 Dell Bsafe Micro Edition Suite 4.0.3 Dell Bsafe Micro Edition Suite 4.0.4 Dell Bsafe Micro Edition Suite 4.0.5 Dell Bsafe Micro Edition Suite 4.0.5.3 Dell Bsafe Micro Edition Suite 4.0.6 Dell Bsafe Micro Edition Suite 4.0.7 Dell Bsafe Micro Edition Suite 4.0.8 Dell Bsafe Micro Edition Suite 4.0.9 Dell Bsafe Micro Edition Suite 4.0.10 Dell Bsafe Micro Edition Suite 4.0.11 Dell Bsafe Micro Edition Suite 4.0.12 Dell Bsafe Micro Edition Suite 4.0.13 Dell Bsafe Micro Edition Suite 4.1.0 Dell Bsafe Micro Edition Suite 4.1.0.1 Dell Bsafe Micro Edition Suite 4.1.1 Dell Bsafe Micro Edition Suite 4.1.2 Dell Bsafe Micro Edition Suite 4.1.3 Dell Bsafe Micro Edition Suite 4.1.4 Dell Bsafe Micro Edition Suite 4.1.5 Dell Bsafe Micro Edition Suite 4.1.6 Dell Bsafe Micro Edition Suite 4.1.6.1 Dell Bsafe Micro Edition Suite 4.1.6.2 Dell Bsafe Micro Edition Suite 4.1.6.3 Dell Bsafe Micro Edition Suite 4.2.0 Dell Bsafe Micro Edition Suite 4.3 Dell Bsafe Micro Edition Suite 4.3.1 Dell Bsafe Micro Edition Suite 4.3.2 Dell Bsafe Micro Edition Suite 4.3.3 Dell Bsafe Micro Edition Suite 4.4 Dell Bsafe Micro Edition Suite 4.4.0 Dell Bsafe Micro Edition Suite 4.5 Dell Bsafe Micro Edition Suite 4.5.1 Dell Bsafe Crypto C Micro Edition 3.0.0.0 Dell Bsafe Crypto C Micro Edition 3.0.0.1 Dell Bsafe Crypto C Micro Edition 3.0.0.14 Dell Bsafe Crypto C Micro Edition 3.0.0.15 Dell Bsafe Crypto C Micro Edition 3.0.0.16 Dell Bsafe Crypto C Micro Edition 3.0.0.19 Dell Bsafe Crypto C Micro Edition 3.0.0.20 Dell Bsafe Crypto C Micro Edition 4.0 Dell Bsafe Crypto C Micro Edition 4.0.0 Dell Bsafe Crypto C Micro Edition 4.0.1 Dell Bsafe Crypto C Micro Edition 4.0.2 Dell Bsafe Crypto C Micro Edition 4.0.3 Dell Bsafe Crypto C Micro Edition 4.0.4 Dell Bsafe Crypto C Micro Edition 4.0.5 Dell Bsafe Crypto C Micro Edition 4.0.5.2 Dell Bsafe Crypto C Micro Edition 4.0.5.3 Dell Bsafe Crypto C Micro Edition 4.0.5.4 Dell Bsafe Crypto C Micro Edition 4.1 Dell Bsafe Crypto C Micro Edition 4.1.0 Dell Bsafe Crypto C Micro Edition 4.1.1 Dell Bsafe Crypto C Micro Edition 4.1.2 Dell Bsafe Crypto C Micro Edition 4.1.3 Dell Bsafe Crypto C Micro Edition 4.1.3.1 Dell Bsafe Crypto C Micro Edition 4.1.3.2 Dell Bsafe Crypto C Micro Edition 4.1.3.3 Dell Bsafe Crypto C Micro Edition 4.1.4	69
Application	Oracle Oracle Retail Customer Insights 15.0.2 Oracle Retail Customer Insights 16.0.2	2

Common Weakness Enumeration (CWE)

CWE-331 - Insufficient Entropy

Common Attack Pattern Enumeration and Classification (CAPEC)

Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

References