Vulnerability · Published Jul 28, 2020 · Assigned by dell
CVE-2020-5377
Critical 9.1
In plain English
A critical-severity path traversal in Dell Open Manage Server Administrator from Dell. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 48.6% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated remote attacker could potentially exploit these vulnerabilities by sending a crafted Web API request containing directory traversal character sequences to gain file system access on the compromised management station.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Dell | Dell Open Manage Server Administrator | unspecified – before 9.5 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N