CVE-2020-5350 - Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component

Back Back to CVE browser

HIGH

Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component

Published Apr 15, 2020

7.9

HIGH

CVSS 3.1

EPSS 1.98%

Description

Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords and execution of malicious commands on ACM component.

Affected products

Vendor Dell Product Integrated Data Protection Appliance Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <2.0, 2.1, 2.2, 2.3, 2.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Dell

Integrated Data Protection Appliance

n/a

Version	Status	Constraints
unspecified	affected	<2.0, 2.1, 2.2, 2.3, 2.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26532
Advisory
https://www.dell.com/support/security/en-us/details/542518/DSA-2020-079-Dell-EMC-Integrated-Data-Protection-Appliance-Command-Injection-Vulnerability
x_refsource_MISCVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-26532		Advisory
https://www.dell.com/support/security/en-us/details/542518/DSA-2020-079-Dell-EMC-Integrated-Data-Protection-Appliance-Command-Injection-Vulnerability		x_refsource_MISCVendor Advisory