VulnerabilityModified
CVE-2020-5370
Dell EMC OpenManage Enterprise (OME) versions prior to 3.4 contain an arbitrary file overwrite vulnerability.
MEDIUM 6.8EPSS 1.45%
Does this matter?
Lower severity and a low EPSS score (1.45%). Track it; it rarely justifies an emergency change on its own.
Description
Dell EMC OpenManage Enterprise (OME) versions prior to 3.4 contain an arbitrary file overwrite vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to overwrite arbitrary files via directory traversal sequences using a crafted tar file to inject malicious RPMs which may cause a denial of service or perform unauthorized actions.
- CVSS 3.1
- 6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 1.45% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- dell/emc openmanage enterprise
- Source
- security_alert@emc.com
References
- https://www.dell.com/support/kbdoc/en-us/000130360/dsa-2020-153-dell-emc-openmanage-enterprise-tar-file-extraction-vulnerabilityPatch, Vendor Advisory
- https://www.dell.com/support/kbdoc/en-us/000130360/dsa-2020-153-dell-emc-openmanage-enterprise-tar-file-extraction-vulnerabilityPatch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.