CVE-2020-29493 : Security Advisory and Response

DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a Critical SQL Injection Vulnerability in Fitness Analyzer, allowing unauthorized access to application data.

Understanding CVE-2020-29493

This CVE involves a severe SQL Injection Vulnerability in Dell's Avamar Server versions 19.1, 19.2, 19.3, potentially leading to unauthorized data access.

What is CVE-2020-29493?

The vulnerability allows remote unauthenticated attackers to execute SQL commands on the backend database, compromising data integrity.
Exploitation could result in unauthorized read and write access to application data, potentially leading to leakage or deletion of sensitive backup data.

The Impact of CVE-2020-29493

Severity: Critical (CVSS Base Score: 10)
Attack Vector: Network
Attack Complexity: Low
Confidentiality, Integrity, and Availability Impact: High
Privileges Required: None
Scope: Changed
Exploitation could lead to severe consequences, including unauthorized data access and potential data loss.

Technical Details of CVE-2020-29493

This section provides detailed technical insights into the vulnerability.

Vulnerability Description

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The vulnerability allows attackers to inject and execute SQL commands on the application's backend database.

Affected Systems and Versions

Product: Avamar
Vendor: Dell
Affected Versions: HF 19.1, 19.2, 19.3 (unspecified version type)

Exploitation Mechanism

Attackers can exploit the vulnerability remotely without authentication, executing SQL commands on the backend database.

Mitigation and Prevention

Protect your systems from CVE-2020-29493 by following these mitigation strategies.

Immediate Steps to Take

Upgrade Avamar Server to the latest version provided by Dell EMC.
Implement network security measures to restrict unauthorized access.
Monitor database activities for any suspicious SQL injection attempts.

Long-Term Security Practices

Regularly update and patch software to address known vulnerabilities.
Conduct security assessments and penetration testing to identify and remediate weaknesses.

Patching and Updates

Dell EMC recommends customers to upgrade Avamar Server to mitigate the SQL Injection Vulnerability.