PT-2021-11677 · Dell · Dell Emc Avamar Server

Published 2021-01-14 · Updated 2021-01-21 · CVE-2020-29495

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: DELL EMC Avamar Server versions 19.1 through 19.3

Description: The issue is an OS Command Injection Vulnerability in the Fitness Analyzer component. A remote unauthenticated attacker could potentially exploit this, leading to the execution of arbitrary OS commands on the application's underlying OS with high privileges. This can be leveraged to completely compromise the vulnerable application as well as the underlying operating system.

Recommendations: For versions 19.1 through 19.3, upgrade to a newer version at the earliest opportunity to resolve the issue. As a temporary workaround, consider restricting access to the Fitness Analyzer component until a patch is available.

Fix

OS Command Injection

Path traversal

Weakness Enumeration

CWE-78

CWE-22

Related Identifiers

CVE-2020-29495

Affected Products

Dell Emc Avamar Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-29495 · Security Note
• https://dell.com/support/kbdoc/en-us/000181806/dsa-2020-272-dell-emc-avamar-server-security-update-for-multiple-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-29495 · Vendor Advisory
• https://t.me/cvenotify/8556 · Telegram Post
• https://t.me/cibsecurity/22189 · Telegram Post