PT-2020-18423 · Dell · Dell Powerprotect Data Manager+1

Published 2020-07-06 · Updated 2020-07-20 · CVE-2020-5356

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Manager (PPDM) versions prior to 19.4 Dell PowerProtect X400 versions prior to 3.2

Description The issue concerns an improper authorization vulnerability. A remote authenticated malicious user may download any file from the affected PowerProtect virtual machines.

Recommendations For Dell PowerProtect Data Manager (PPDM) versions prior to 19.4, update to version 19.4 or later. For Dell PowerProtect X400 versions prior to 3.2, update to version 3.2 or later.

Fix

Improper Authorization

Files Accessible to External Parties

Weakness Enumeration

CWE-285

CWE-552

Related Identifiers

CVE-2020-5356

Affected Products

Dell Powerprotect Data Manager

Dell Powerprotect X400

References · 4

• https://dell.com/support/security/en-us/details/544733/DSA-2020-099-Dell-PowerProtect-Data-Manager-Improper-Authorization-Vulnerability · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-5356 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-5356 · Security Note
• https://t.me/cvenotify/4876 · Telegram Post