CVE-2020-5370

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-22 · updated 2026-06-17
Weakness: CWE-22

Description

Dell EMC OpenManage Enterprise (OME) versions prior to 3.4 contain an arbitrary file overwrite vulnerability. A remote authenticated malicious user with high privileges could potentially exploit this vulnerability to overwrite arbitrary files via directory traversal sequences using a crafted tar file to inject malicious RPMs which may cause a denial of service or perform unauthorized actions.

Affected products

Dell Emc Openmanage Enterprise: before 3.4 — fixed in 3.4

How to fix

Upgrade to a fixed version: Dell Emc Openmanage Enterprise 3.4. Check the vendor advisory for mitigations.

References

https://www.dell.com/support/kbdoc/en-us/000130360/dsa-2020-153-dell-emc-openmanage-enterprise-tar-file-extraction-vulnerability
https://www.dell.com/support/kbdoc/en-us/000130360/dsa-2020-153-dell-emc-openmanage-enterprise-tar-file-extraction-vulnerability

Get alerted when CVE-2020-5370 or the next vulnerability affects your stack