« Volver al listado

CVE-2020-5341

Estado: ModificadaCrítica (9.8)—

Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.2 and Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 and 2.4.1 contain a Deserialization of Untrusted Data Vulnerability. A remote unauthenticated attacker could exploit this vulnerability to send a serialized payload that would execute code on the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Dell — EMC Avamar ServerDell — EMC Integrated Data Protection Appliance Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-5341",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security_alert@emc.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security_alert@emc.com",
      "affectedData": [
        {
          "vendor": "Dell",
          "product": "Avamar Virtual Edition",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "Avamar 7.5 Virtual Edition for VMware vSphere only",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2021-07-28T00:15:07.637",
  "references": [
    {
      "url": "https://www.dell.com/support/security/en-us/details/541677/DSA-2020-057-Dell-EMC-Avamar-Server-Deserialization-of-Untrusted-Data-Vulnerability",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "security_alert@emc.com"
    },
    {
      "url": "https://www.dell.com/support/security/en-us/details/541677/DSA-2020-057-Dell-EMC-Avamar-Server-Deserialization-of-Untrusted-Data-Vulnerability",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security_alert@emc.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Deserialization of Untrusted Data Vulnerability Dell EMC Avamar Server versions 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 and 19.2 and Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 and 2.4.1 contain a Deserialization of Untrusted Data Vulnerability. A remote unauthenticated attacker could exploit this vulnerability to send a serialized payload that would execute code on the system."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de deserialización de datos no confiables Las versiones 7.4.1, 7.5.0, 7.5.1, 18.2, 19.1 y 19.2 de Dell EMC Avamar Server y las versiones 2.0, 2.1, 2.2, 2.3, 2.4 y 2.4.1 de Dell EMC Integrated Data Protection Appliance contienen una vulnerabilidad de deserialización de datos no confiables. Un atacante remoto no autenticado podría aprovechar esta vulnerabilidad para enviar una carga útil serializada que ejecutaría código en el sistema."
    }
  ],
  "lastModified": "2026-06-17T03:21:18.713",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:dell:emc_avamar_server:7.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D31DB2E9-502A-4097-B7D0-01BD33CB5DC3"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_avamar_server:7.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2505F76D-6AB8-489A-AB9D-9069B9A9025E"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_avamar_server:7.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B5714A80-1068-4C43-AF9F-2176C72D1416"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_avamar_server:18.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ABDC11FA-A04A-4578-99BA-D6A2AE0051A8"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_avamar_server:18.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "52BE822E-6FD6-4FC8-9DFC-A4073D31B58C"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_avamar_server:19.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D055384E-1362-43FC-BD4C-9FAED912FE1F"
            },
            {
              "criteria": "cpe:2.3:a:dell:emc_avamar_server:19.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB61C3E2-E97A-48FA-BECE-3593B77C1386"
            },
            {
              "criteria": "cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C133A08-973B-43E2-8E0C-9B7AEF467BDD"
            },
            {
              "criteria": "cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "889D0DDB-7D31-4AE9-972A-AE14CC2A82BF"
            },
            {
              "criteria": "cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "970D60B9-9DAD-4F1D-BFBE-BB069756011C"
            },
            {
              "criteria": "cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1335A62E-B8AB-4D72-A8CE-D2E79EFC42A3"
            },
            {
              "criteria": "cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7B70F149-1646-4D04-A693-A6263011540D"
            },
            {
              "criteria": "cpe:2.3:o:dell:emc_integrated_data_protection_appliance_firmware:2.4.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "56CA7E2E-33D7-48CE-9AAF-2474933BE95B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security_alert@emc.com"
}