cnvd - cnvd-2020-32851

CNVD-2020-32851

Vulnerability from cnvd - Published: 2020-06-13

Title

Dell EMC Integrated Data Protection Appliance操作系统命令注入漏洞

Description

Dell EMC Integrated Data Protection Appliance是美国戴尔（Dell）公司的一套基于磁盘的备份和恢复解决方案。ACM是其中的一个应用配置管理组件。 Dell EMC Integrated Data Protection Appliance中的ACM组件存在操作系统命令注入漏洞。攻击者可借助特制参数利用该漏洞操纵密码和执行恶意命令。

Severity

高

Patch Name

Dell EMC Integrated Data Protection Appliance操作系统命令注入漏洞的补丁

Patch Description

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://www.dell.com/support/security/en-us/details/542518/DSA-2020-079-Dell-EMC-Integrated-Data-Protection-Appliance-Command-Injection-Vulnerability

Reference

https://nvd.nist.gov/vuln/detail/CVE-2020-5350

Impacted products

Name
['DELL Dell EMC Integrated Data Protection Appliance 2.0', 'DELL Dell EMC Integrated Data Protection Appliance 2.1', 'DELL Dell EMC Integrated Data Protection Appliance 2.2', 'DELL Dell EMC Integrated Data Protection Appliance 2.3', 'DELL Dell EMC Integrated Data Protection Appliance 2.4']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-5350"
    }
  },
  "description": "Dell EMC Integrated Data Protection Appliance\u662f\u7f8e\u56fd\u6234\u5c14\uff08Dell\uff09\u516c\u53f8\u7684\u4e00\u5957\u57fa\u4e8e\u78c1\u76d8\u7684\u5907\u4efd\u548c\u6062\u590d\u89e3\u51b3\u65b9\u6848\u3002ACM\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u5e94\u7528\u914d\u7f6e\u7ba1\u7406\u7ec4\u4ef6\u3002\n\nDell EMC Integrated Data Protection Appliance\u4e2d\u7684ACM\u7ec4\u4ef6\u5b58\u5728\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u53c2\u6570\u5229\u7528\u8be5\u6f0f\u6d1e\u64cd\u7eb5\u5bc6\u7801\u548c\u6267\u884c\u6076\u610f\u547d\u4ee4\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://www.dell.com/support/security/en-us/details/542518/DSA-2020-079-Dell-EMC-Integrated-Data-Protection-Appliance-Command-Injection-Vulnerability",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-32851",
  "openTime": "2020-06-13",
  "patchDescription": "Dell EMC Integrated Data Protection Appliance\u662f\u7f8e\u56fd\u6234\u5c14\uff08Dell\uff09\u516c\u53f8\u7684\u4e00\u5957\u57fa\u4e8e\u78c1\u76d8\u7684\u5907\u4efd\u548c\u6062\u590d\u89e3\u51b3\u65b9\u6848\u3002ACM\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u5e94\u7528\u914d\u7f6e\u7ba1\u7406\u7ec4\u4ef6\u3002\r\n\r\nDell EMC Integrated Data Protection Appliance\u4e2d\u7684ACM\u7ec4\u4ef6\u5b58\u5728\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u53c2\u6570\u5229\u7528\u8be5\u6f0f\u6d1e\u64cd\u7eb5\u5bc6\u7801\u548c\u6267\u884c\u6076\u610f\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Dell EMC Integrated Data Protection Appliance\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "DELL Dell EMC Integrated Data Protection Appliance 2.0",
      "DELL Dell EMC Integrated Data Protection Appliance 2.1",
      "DELL Dell EMC Integrated Data Protection Appliance 2.2",
      "DELL Dell EMC Integrated Data Protection Appliance 2.3",
      "DELL Dell EMC Integrated Data Protection Appliance 2.4"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2020-5350",
  "serverity": "\u9ad8",
  "submitTime": "2020-04-16",
  "title": "Dell EMC Integrated Data Protection Appliance\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e"
}

CVE-2020-5350 (GCVE-0-2020-5350)

Vulnerability from cvelistv5 – Published: 2020-04-15 18:00 – Updated: 2024-09-16 17:54

Summary

Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords and execution of malicious commands on ACM component.

Severity ?

7.9 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

dell

References

URL

Tags

https://www.dell.com/support/security/en-us/detai…

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Dell	Integrated Data Protection Appliance	Affected: unspecified , < 2.0, 2.1, 2.2, 2.3, 2.4 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T08:30:23.318Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.dell.com/support/security/en-us/details/542518/DSA-2020-079-Dell-EMC-Integrated-Data-Protection-Appliance-Command-Injection-Vulnerability"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Integrated Data Protection Appliance",
          "vendor": "Dell",
          "versions": [
            {
              "lessThan": "2.0, 2.1, 2.2, 2.3, 2.4",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2020-03-31T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords and execution of malicious commands on ACM component."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.9,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-04-15T18:00:18",
        "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
        "shortName": "dell"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.dell.com/support/security/en-us/details/542518/DSA-2020-079-Dell-EMC-Integrated-Data-Protection-Appliance-Command-Injection-Vulnerability"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@dell.com",
          "DATE_PUBLIC": "2020-03-31",
          "ID": "CVE-2020-5350",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Integrated Data Protection Appliance",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "2.0, 2.1, 2.2, 2.3, 2.4"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Dell"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords and execution of malicious commands on ACM component."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": 7.9,
            "baseSeverity": "High",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.dell.com/support/security/en-us/details/542518/DSA-2020-079-Dell-EMC-Integrated-Data-Protection-Appliance-Command-Injection-Vulnerability",
              "refsource": "MISC",
              "url": "https://www.dell.com/support/security/en-us/details/542518/DSA-2020-079-Dell-EMC-Integrated-Data-Protection-Appliance-Command-Injection-Vulnerability"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe",
    "assignerShortName": "dell",
    "cveId": "CVE-2020-5350",
    "datePublished": "2020-04-15T18:00:18.727517Z",
    "dateReserved": "2020-01-03T00:00:00",
    "dateUpdated": "2024-09-16T17:54:54.783Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2020-32851

CVE-2020-5350 (GCVE-0-2020-5350)

Tags

Sightings

Nomenclature