CVE-2019-3723 Web Parameter Tampering Vulnerability
Remote attackers can manipulate web parameters to create arbitrary files or delete existing file contents in Dell EMC OpenManage Server Administrator.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-3723?
CVE-2019-3723 is a critical path traversal vulnerability in Dell EMC OpenManage Server Administrator, published on 6 Jun 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain a web parameter tampering vulnerability. A remote unauthenticated attacker could potentially manipulate parameters of web requests to OMSA to create arbitrary files with empty content or delete the contents of any existing file, due to improper input parameter validation
Weakness: CWE-20
Which versions are affected by CVE-2019-3723?
It affects 1 product.
Products include Dell Emc Openmanage Server Administrator.
How do I fix CVE-2019-3723?
No fix has been published for CVE-2019-3723 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2019-3723 being exploited?
There is no known exploitation of CVE-2019-3723 in the wild and no public exploit code.
Other vulnerabilities in Dell EMC OpenManage Server Administrator
- CVE-2020-5377 Path traversal in Dell Open Manage Server Administrator
- CVE-2019-3722 XML External Entity (XXE) Injection Vulnerability
- CVE-2023-43079 Privilege escalation in Dell OpenManage Server Administrator
- CVE-2019-3720 Directory Traversal Vulnerability
- CVE-2019-3721 Improper Range Header Processing Vulnerability
Sources
Also known as GHSA-wfrv-224c-7qxp.