« Back to list

CVE-2020-5318

Status: ModifiedHigh (7.5)—

Dell EMC Isilon OneFS versions 8.1.2, 8.1.0.4, 8.1.0.3, and 8.0.0.7 contain a vulnerability in some configurations. An attacker may exploit this vulnerability to gain access to restricted files. The non-RAN HTTP and WebDAV file-serving components have a vulnerability wherein when either are enabled, and Basic Authentication is enabled for either or both components, files are accessible without authentication.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Dell — EMC Isilon Onefs

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2020-5318",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "Isilon OneFS",
          "versions": [
            {
              "status": "affected",
              "version": "8.1.2, 8.1.0.4, 8.1.0.3, 8.0.0.7"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-02-06T18:15:13.760",
  "references": [
    {
      "url": "https://www.dell.com/support/security/en-us/details/540708/DSA-2020-018-Dell-EMC-Isilon-OneFS-Security-Update-for-Improper-Authorization-Vulnerability",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.dell.com/support/security/en-us/details/540708/DSA-2020-018-Dell-EMC-Isilon-OneFS-Security-Update-for-Improper-Authorization-Vulnerability",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security_alert@emc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-285"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Dell EMC Isilon OneFS versions 8.1.2, 8.1.0.4, 8.1.0.3, and 8.0.0.7 contain a vulnerability in some configurations. An attacker may exploit this vulnerability to gain access to restricted files. The non-RAN HTTP and WebDAV file-serving components have a vulnerability wherein when either are enabled, and Basic Authentication is enabled for either or both components, files are accessible without authentication."
    },
    {
      "lang": "es",
      "value": "Dell EMC Isilon OneFS versiones 8.1.2, 8.1.0.4, 8.1.0.3 y 8.0.0.7, presenta una vulnerabilidad en algunas configuraciones. Un atacante puede explotar esta vulnerabilidad para conseguir acceso a archivos restringidos. Los componentes non-RAN HTTP y WebDAV file-serving presentan una vulnerabilidad en la que cuando están habilitados y la Autenticación Básica está habilitada para uno o ambos componentes, los archivos son accesibles sin autenticación."
    }
  ],
  "lastModified": "2026-06-17T03:21:16.160",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:emc_isilon_onefs:8.0.0.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9CAB8285-AC1A-415D-883B-B0A933DE7328"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_isilon_onefs:8.1.0.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "341D1B64-E77A-4531-86FD-CF6436F89589"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_isilon_onefs:8.1.0.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "80CF5546-BD02-439A-816A-9FBC89EB9482"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_isilon_onefs:8.1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6436EE3D-5DAD-4486-B030-7DA5D6AAB20A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}