An SQL injection vulnerability in Dell OpenManage Enterprise allows authenticated attackers to manipulate database queries, leading to potential unauthorized data access or system control.

This vulnerability is an improper neutralization of special elements used in an SQL command (CWE-89). It requires the attacker to be authenticated to the system, from which they can inject malicious SQL statements to interact with the backend database.

With a CVSS score of 8.8, this vulnerability poses a significant risk to the integrity and confidentiality of infrastructure management data. Unauthorized database access could lead to the exposure of sensitive management configurations or the modification of system states, resulting in severe operational disruption.

Immediate Action: Upgrade to Dell OpenManage Enterprise version 4.7.0 or later immediately to resolve the vulnerable code path.

Proactive Monitoring: Monitor database query logs for syntax errors or anomalous patterns that suggest SQL injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to inspect and filter traffic directed at the OpenManage interface.

Public Exploit Available: No

Organizations utilizing OpenManage Enterprise must treat this as a high priority update. Apply the 4.7.0 patch as soon as maintenance windows permit to eliminate the risk of database compromise.