CVE-2020-5356 Missing authorization in Power Protect Data Manager
Remote authenticated users can download arbitrary files from Dell PowerProtect virtual machines due to improper authorization checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-5356?
CVE-2020-5356 is a high-severity missing authorization vulnerability in Dell Power Protect Data Manager, published on 6 Jul 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Dell PowerProtect Data Manager (PPDM) versions prior to 19.4 and Dell PowerProtect X400 versions prior to 3.2 contain an improper authorization vulnerability. A remote authenticated malicious user may download any file from the affected PowerProtect virtual machines.
Which versions are affected by CVE-2020-5356?
It affects 2 products.
Products include Dell Powerprotect Data Manager, Dell Powerprotect X400 Firmware.
How do I fix CVE-2020-5356?
No fix has been published for CVE-2020-5356 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-5356 being exploited?
There is no known exploitation of CVE-2020-5356 in the wild and no public exploit code.
Other vulnerabilities in Dell Power Protect Data Manager
- CVE-2026-40712 Privilege escalation in PowerProtect Data Manager
- CVE-2026-46738 Privilege escalation in PowerProtect Data Manager
- CVE-2026-49499 Privilege escalation in PowerProtect Data Manager
- CVE-2025-43888 Information disclosure in PowerProtect Data Manager
- CVE-2024-22454 Auth bypass in PowerProtect Data Manager
Sources
Also known as GHSA-f5jv-3q57-gqc5.