Vulnerability · Published Mar 6, 2020 · Assigned by dell
CVE-2020-5327
High 8.1
In plain English
A high-severity unsafe deserialization in Dell Encryption Enterprise from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)3.7%top 10.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Dell Security Management Server versions prior to 10.2.10 contain a Java RMI Deserialization of Untrusted Data vulnerability. When the server is exposed to the internet and Windows Firewall is disabled, a remote unauthenticated attacker may exploit this vulnerability by sending a crafted RMI request to execute arbitrary code on the target host.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dell | Dell Encryption Enterprise | unspecified – before 10.2.10 |
Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.dell.com/support/article/SLN320536 x_refsource_MISC