DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a SQL Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of certain SQL commands on the application's backend database, causing unauthorized read and write access to application data. Exploitation may lead to leakage or deletion of sensitive backup data; hence the severity is Critical. Dell EMC recommends customers to upgrade at the earliest opportunity.
References
| Link | Resource |
|---|---|
| https://www.dell.com/support/kbdoc/en-us/000181806/dsa-2020-272-dell-emc-avamar-server-security-update-for-multiple-vulnerabilities | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Jan 2021, 17:54
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 7.5
v3 : 9.8 |
| CWE | CWE-89 | |
| CPE | cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.5:*:*:*:*:*:*:* cpe:2.3:a:dell:emc_avamar_server:19.2:*:*:*:*:*:*:* cpe:2.3:a:dell:emc_avamar_server:19.1:*:*:*:*:*:*:* cpe:2.3:a:dell:emc_integrated_data_protection_appliance:2.6:*:*:*:*:*:*:* cpe:2.3:a:dell:emc_avamar_server:19.3:*:*:*:*:*:*:* |
|
| References | (CONFIRM) https://www.dell.com/support/kbdoc/en-us/000181806/dsa-2020-272-dell-emc-avamar-server-security-update-for-multiple-vulnerabilities - Patch, Vendor Advisory |
14 Jan 2021, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-01-14 21:15
Updated : 2023-12-10 13:41
NVD link : CVE-2020-29493
Mitre link : CVE-2020-29493
CVE.ORG link : CVE-2020-29493
JSON object : View
Products Affected
dell
- emc_integrated_data_protection_appliance
- emc_avamar_server
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')