CVE-2020-36695 File and Directory Permission Vulnerability in Hitachi Command Suite
Incorrect default permissions in Hitachi management software allow local attackers to manipulate files, potentially leading to privilege escalation or data modification.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-36695?
CVE-2020-36695 is a medium-severity vulnerability in Hitachi Compute Systems Manager, published on 18 Jul 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Incorrect Default Permissions vulnerability in Hitachi Device Manager on Linux (Device Manager Server component), Hitachi Tiered Storage Manager on Linux, Hitachi Replication Manager on Linux, Hitachi Tuning Manager on Linux (Hitachi Tuning Manager server, Hitachi Tuning Manager - Agent for RAID, Hitachi Tuning Manager - Agent for NAS
components), Hitachi Compute Systems Manager on Linux allows File Manipulation.This issue affects Hitachi Device Manager: before 8.8.5-02; Hitachi Tiered Storage Manager: before 8.8.5-02; Hitachi Replication Manager: before 8.8.5-02; Hitachi Tuning Manager: before 8.8.5-02; Hitachi Compute Systems Manager: before 8.8.3-08.
Weakness: CWE-276
Which versions are affected by CVE-2020-36695?
It affects 5 products.
Products include Hitachi Compute Systems Manager, Hitachi Device Manager, Hitachi Replication Manager, Hitachi Tiered Storage Manager, Hitachi Tuning Manager.
How do I fix CVE-2020-36695?
No fix has been published for CVE-2020-36695 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-36695 being exploited?
There is no known exploitation of CVE-2020-36695 in the wild and no public exploit code.
Other vulnerabilities in Hitachi Compute Systems Manager
Sources
Also known as GHSA-m5wh-8x43-f8p3.