Vulnerability · Published Jul 6, 2020 · Assigned by dell

CVE-2020-5368

Critical 9.8

In plain English

A critical-severity missing authorization in VxRail from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.0%top 19.3% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Dell EMC VxRail versions 4.7.410 and 4.7.411 contain an improper authentication vulnerability. A remote unauthenticated attacker may exploit this vulnerability to obtain sensitive information in an encrypted form.

Affected products (as reported)

Vendor	Product	Versions
Dell	VxRail	4.7.410, 4.7.411

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.dell.com/support/security/en-us/details/544058/DSA-2020-136-Dell-EMC-VxRail-Appliance-Improper-Authentication-Vulnerability x_refsource_MISC