DSA ID: DSA-2020-128
CVE Identifier: CVE-2020-5366
Severity Rating: CVSSv3 Base Score: 7.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L)
Dell EMC iDRAC has been updated to address a vulnerability that may be exploited to compromise the affected systems.
Dell EMC iDRAC9 versions prior to 184.108.40.206 contain a Path Traversal Vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability by manipulating input parameters to gain unauthorized read access to the arbitrary files.
The following Dell EMC iDRAC firmware releases contain resolutions to these vulnerabilities:
|iDRAC||iDRAC firmware version|
Note: Available as of the publication date.
Dell EMC recommends all customers upgrade at the earliest opportunity.
Dell EMC Best Practices regarding iDRAC:
Link to remedies:
Customers can download software, including the latest release of iDRAC firmware, from the Dell Support site.
Customers can find the iDRAC documentation from the Dell EMC Support site.
CVE-2020-5366: Dell EMC would like to thank Georgy Kiguradze and Mark Ermolov from Positive Technologies
Dell EMC recommends that all users determine the applicability of this information to their individual situations and take appropriate action. The information set forth herein is provided "as is" without warranty of any kind. Dell EMC disclaims all warranties, either express or implied, including the warranties of merchantability, fitness for a particular purpose, title and non-infringement. In no event shall Dell EMC, or its suppliers, be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Dell EMC or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages, so the foregoing limitation may not apply.
Article ID: SLN322125Last Date Modified: 07/07/2020 10:57 AM