Path Traversal Vulnerability in Dell EMC OpenManage Server Administrator
CVE-2021-21514

4.9MEDIUM

Key Information:

Vendor
Dell
Status
Dell Open Manage Server Administrator
Vendor
CVE Published:
2 March 2021

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 12%

Summary

Dell EMC OpenManage Server Administrator (OMSA) versions 9.5 and earlier are susceptible to a path traversal vulnerability. This flaw allows an authenticated remote user with administrative privileges to craft specific URL requests that can disclose sensitive files on the server. Exploiting this vulnerability could lead to unauthorized access to critical system information, emphasizing the need for timely updates and patches to safeguard against potential threats.

Affected Version(s)

Dell Open Manage Server Administrator <= 9.5

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

AFR-in-OMSA
Created by und3sc0n0c1d0

References

https://www.dell.com/support/kbdoc/en-us/000183670/dsa-20...
x_refsource_MISC

EPSS Score

12% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.