Headline
CVE-2020-5323: DSA-2020-023: Dell EMC OpenManage Enterprise & Enterprise-Modular Multiple Vulnerabilities
Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an injection vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability to gain access to sensitive information or cause denial-of-service.
Vaikutus
Critical
Tiedot
- SQL Injection Vulnerability (CVE-2020-5320)
Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a SQL injection vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to execute SQL commands to perform unauthorized actions.
CVSSv3 Base Score 9.0 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H)
- Improper Input Validation Vulnerability (CVE-2020-5321)
Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an improper input validation vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to spawn tasks with elevated privileges.
CVSSv3 Base Score 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H)
- Command Injection Vulnerability (CVE-2020-5322)
Dell EMC OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a command injection vulnerability. A remote authenticated malicious user with high privileges could potentially exploit the vulnerability to execute arbitrary shell commands on the affected system.
CVSSv3 Base Score 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
- Injection Vulnerability (CVE-2020-5323)
Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an injection vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability to gain access to sensitive information or cause denial-of-service.
CVSSv3 Base Score 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
- SQL Injection Vulnerability (CVE-2020-5320)
Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a SQL injection vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to execute SQL commands to perform unauthorized actions.
CVSSv3 Base Score 9.0 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H)
- Improper Input Validation Vulnerability (CVE-2020-5321)
Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an improper input validation vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to spawn tasks with elevated privileges.
CVSSv3 Base Score 7.6 (AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H)
- Command Injection Vulnerability (CVE-2020-5322)
Dell EMC OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a command injection vulnerability. A remote authenticated malicious user with high privileges could potentially exploit the vulnerability to execute arbitrary shell commands on the affected system.
CVSSv3 Base Score 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
- Injection Vulnerability (CVE-2020-5323)
Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain an injection vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability to gain access to sensitive information or cause denial-of-service.
CVSSv3 Base Score 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L)
Dell Technologies suosittelee, että kaikki asiakkaat ottavat huomioon sekä CVSS-peruspistemäärän että kaikki asiaankuuluvat väliaikaiset ja ympäristöön liittyvät pisteet, jotka voivat vaikuttaa tietyn tietoturvahaavoittuvuuden mahdolliseen vakavuuteen.
Tuotteet, joihin asia vaikuttaa ja tilanteen korjaaminen
Affected products:
- Dell EMC OpenManage Enterprise (OME) versions prior to 3.2
- Dell EMC OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00
Remediation:
The following Dell EMC OpenManage Enterprise (OME) and OpenManage Enterprise-Modular (OME-M) releases contain resolutions to these vulnerabilities:
- Dell EMC OpenManage Enterprise (OME) 3.2 and later
- Dell EMC OpenManage Enterprise-Modular (OME-M) 1.10.00 and later
Dell EMC recommends all customers upgrade at the earliest opportunity.
Customers can download for PowerEdge servers. For all other platforms, please select the platform from the Dell support site.
Affected products:
- Dell EMC OpenManage Enterprise (OME) versions prior to 3.2
- Dell EMC OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00
Remediation:
The following Dell EMC OpenManage Enterprise (OME) and OpenManage Enterprise-Modular (OME-M) releases contain resolutions to these vulnerabilities:
- Dell EMC OpenManage Enterprise (OME) 3.2 and later
- Dell EMC OpenManage Enterprise-Modular (OME-M) 1.10.00 and later
Dell EMC recommends all customers upgrade at the earliest opportunity.
Customers can download for PowerEdge servers. For all other platforms, please select the platform from the Dell support site.
Asiaan liittyvät tiedot
Dell Security Advisories and Notices
Dell Vulnerability Response Policy
CVSS Scoring Guide
21 helmik. 2021