CVE-2020-5377 Path traversal in Dell Open Manage Server Administrator
Unauthenticated remote attackers can exploit path traversal in Dell OMSA to access files on the management station.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-5377?
CVE-2020-5377 is a critical path traversal vulnerability in Dell Open Manage Server Administrator, published on 28 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated remote attacker could potentially exploit these vulnerabilities by sending a crafted Web API request containing directory traversal character sequences to gain file system access on the compromised management station.
Weakness: CWE-22
Which versions are affected by CVE-2020-5377?
It affects 1 product.
Products include Dell Emc Openmanage Server Administrator.
How do I fix CVE-2020-5377?
No fix has been published for CVE-2020-5377 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-5377 being exploited?
There is no known exploitation of CVE-2020-5377 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 2 proofs of concept on GitHub.
Other vulnerabilities in Dell Open Manage Server Administrator
- CVE-2019-3723 Web Parameter Tampering Vulnerability
- CVE-2019-3722 XML External Entity (XXE) Injection Vulnerability
- CVE-2023-43079 Privilege escalation in Dell OpenManage Server Administrator
- CVE-2019-3720 Directory Traversal Vulnerability
- CVE-2019-3721 Improper Range Header Processing Vulnerability
Sources
Also known as GHSA-jcx7-mqqf-7jxj.