Description

Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.1",
  "pubDate": "2026-09-03T13:06:07.307Z",
  "pubdate": "2026-09-03T13:06:07.307Z",
  "executiveSummary": "Dell PowerProtect Data Manager versions 20.2.0.0 and below are susceptible to a Server-Side Request Forgery (SSRF) vulnerability located within the REST API.\nThis vulnerability enables a remote attacker with high-level privileges to manipulate the server into initiating unauthorized outbound requests to internal or external resources.\nThe primary impact of this flaw is unauthorized information disclosure, potentially allowing the attacker to probe the internal network architecture, access sensitive metadata, or retrieve internal service responses that are otherwise protected from public view.\nExploitation requires the attacker to possess elevated authentication credentials, limiting the attack surface to malicious actors who have already gained significant administrative access to the platform.\nGiven the nature of the SSRF, the integrity and confidentiality of the host environment and associated infrastructure are at risk.",
  "technicalDetails": "The vulnerability resides in the REST API component of Dell PowerProtect Data Manager, which fails to adequately validate or sanitize user-supplied input provided to specific API endpoints before using it to construct outbound HTTP requests.\nServer-Side Request Forgery occurs when an application processes a URL or address provided by a client without sufficient verification. In this instance, the API acts as a proxy, allowing an authenticated, high-privileged user to force the application to perform requests on behalf of the server to arbitrary targets.\nThe attack flow begins with the attacker identifying the vulnerable API endpoint. Upon successful authentication, the attacker crafts a malicious request containing a payload that targets internal IP addresses, loopback addresses, or sensitive internal REST services.\nBecause the server initiates these requests, the traffic originates from a trusted host within the internal network. This allows the attacker to bypass firewall rules and perimeter security controls that would normally block direct access to backend resources.\nThe server-side component processes the input and subsequently issues a request to the target resource. If the target is reachable, the server receives the response—which may contain sensitive configuration data, internal system logs, or metadata—and returns the output to the attacker.\nThis exploit effectively circumvents network segmentation and allows for the mapping of internal subnets, identification of other service versions, and potentially the extraction of sensitive data stored on internal systems that are reachable by the PowerProtect server.\nThe vulnerability is specifically present in versions 20.2.0.0 and below. The requirement for high-level privileges indicates that this flaw facilitates vertical and horizontal privilege abuse, moving beyond the standard administrative scope intended for the user.\nSuccessful exploitation results in significant Information Disclosure, as the attacker can leverage the server's identity to retrieve data that should be isolated from the API layer."
}