Improper input validation in Java Advanced Management Console - CVE-2020-2764

Vulnerability identifier: #VU27226

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-2764

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Advanced Management Console component in Java SE. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Java Advanced Management Console
Data Computing Appliance (DCA)
Secure Remote Services (SRS) Virtual Edition
EMC ECS
Solutions Enabler
Unisphere for PowerMax Virtual Appliance
Unisphere for PowerMax
Solutions Enabler Virtual Appliance
Dell EMC Data Protection Search

Install updates from vendor's website.

Data Computing Appliance (DCA) - update to 3.5.5.0
Secure Remote Services (SRS) Virtual Edition - update to 3.46.00.04
EMC ECS - addressed in versions 3.5.1.1, 3.6
Solutions Enabler Virtual Appliance - addressed in versions 9.0.0.19, 9.1.0.6
Solutions Enabler - addressed in versions 9.0.0.19, 9.1.0.6
Unisphere for PowerMax Virtual Appliance - addressed in versions 9.0.2.18, 9.1.0.17
Unisphere for PowerMax - addressed in versions 9.0.2.18, 9.1.0.17
Dell EMC Data Protection Search - update to 19.3.0

• https://www.oracle.com/security-alerts/cpuapr2020.html

• Improper input validation in Java Advanced Management Console
• Multiple vulnerabilities in Dell EMC ECS
• Multiple vulnerabilities in Dell EMC Secure Remote Services (SRS) Virtual Edition
• Multiple vulnerabilities in Dell EMC Unisphere for PowerMax and Dell EMC Solutions Enabler
• Multiple vulnerabilities in Dell EMC Data Protection Search
• Multiple vulnerabilities in Dell EMC Data Computing Appliance (DCA)