PT-2020-18399 · Dell Emc · Dell Emc Isilon Onefs

Published 2020-02-06 · Updated 2020-02-11 · CVE-2020-5318

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dell EMC Isilon OneFS versions 8.0.0.7, 8.1.0.3, 8.1.0.4, and 8.1.2

Description The issue allows an attacker to gain access to restricted files in certain configurations. This is due to a vulnerability in the non-RAN HTTP and WebDAV file-serving components when either is enabled and Basic Authentication is enabled for either or both components, resulting in files being accessible without authentication.

Recommendations For versions 8.0.0.7, 8.1.0.3, 8.1.0.4, and 8.1.2, consider disabling the non-RAN HTTP and WebDAV file-serving components or disabling Basic Authentication for these components to minimize the risk of exploitation. Restrict access to sensitive files until a fix is available.

Fix

Incorrect Authorization

Improper Authorization

Weakness Enumeration

CWE-863

CWE-285

Related Identifiers

CVE-2020-5318

Affected Products

Dell Emc Isilon Onefs

References · 3

• https://osv.dev/vulnerability/CVE-2020-5318 · Vendor Advisory
• https://dell.com/support/security/en-us/details/540708/DSA-2020-018-Dell-EMC-Isilon-OneFS-Security-Update-for-Improper-Authorization-Vulnerability · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5318 · Security Note