CVE-2021-21514

CVSS 4.9 MEDIUMEPSS 5.4%CWE-22

In short

Dell EMC OpenManage Server Administrator has a flaw that lets administrators with access view files they shouldn't be able to reach by crafting special web requests. This could expose sensitive system information.

Technical detail

Path traversal vulnerability (CWE-22) in OMSA versions 9.5 and prior allows authenticated admin users to bypass directory restrictions and read arbitrary files via malicious URL parameters. Attack requires admin-level privileges and access to the management interface.

Summary generated and translated by AI from the official description.

Dell EMC OpenManage Server Administrator (OMSA) versions 9.5 and prior contain a path traversal vulnerability. A remote user with admin privileges could potentially exploit this vulnerability to view arbitrary files on the target system by sending a specially crafted URL request.

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected products

Dell · Dell Open Manage Server Administrator

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.dell.com/support/kbdoc/en-us/000183670/dsa-2021-040-dell-emc-openmanage-server-administrator-omsa-security-update-for-multiple-vulnerabilities