CVE-2020-5353

The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System (NFS) allows access to an 'admin' home directory. An attacker may leverage a spoofed Unique Identifier (UID) over NFS to rewrite sensitive files to gain administrative access to the system.

CVSS v3 8.8 HIGH
CVSS v2.0 9.0 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://support.emc.com/kb/542721	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dell:emc_isilon_onefs::::::::
	cpe:2.3:o:dell:emc_powerscale_onefs:9.0.0:::::::*

History

06 Aug 2021, 17:09

Type	Values Removed	Values Added
References	~~(CONFIRM) https://support.emc.com/kb/542721 -~~	(CONFIRM) https://support.emc.com/kb/542721 - Patch, Vendor Advisory
CWE		CWE-276
CPE		cpe:2.3:a:dell:emc_isilon_onefs:::::::: cpe:2.3:o:dell:emc_powerscale_onefs:9.0.0:::::::*
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 9.0 v3 : 8.8

29 Jul 2021, 16:31

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-07-29 16:15

Updated : 2023-12-10 13:55

NVD link : CVE-2020-5353

Mitre link : CVE-2020-5353

CVE.ORG link : CVE-2020-5353

JSON object : View

Products Affected

dell

emc_powerscale_onefs
emc_isilon_onefs

CWE

CWE-276

Incorrect Default Permissions

{"id": "CVE-2020-5353", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2021-07-29T16:15:08.610", "references": [{"url": "https://support.emc.com/kb/542721", "tags": ["Patch", "Vendor Advisory"], "source": "security_alert@emc.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-276"}]}, {"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "The Dell Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale OneFS version 9.0.0 default configuration for Network File System (NFS) allows access to an 'admin' home directory. An attacker may leverage a spoofed Unique Identifier (UID) over NFS to rewrite sensitive files to gain administrative access to the system."}, {"lang": "es", "value": "Dell Isilon OneFS versiones 8.2.2 y anteriores y Dell EMC PowerScale OneFS versiones 9.0.0, una configuraci\u00f3n predeterminada para Network File System (NFS) permite el acceso a un directorio de inicio \"admin\". Un atacante puede aprovechar un Unique Identifier (UID) falsificado a trav\u00e9s de NFS para reescribir archivos confidenciales y conseguir acceso administrativo al sistema"}], "lastModified": "2021-08-06T17:09:29.597", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:emc_isilon_onefs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1041FD80-0BC7-4C1E-B310-B17EB68668D6", "versionEndIncluding": "8.2.2"}, {"criteria": "cpe:2.3:o:dell:emc_powerscale_onefs:9.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5422D856-00B1-47FA-8D62-9B464A43BAC9"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}