CVE-2020-29503 : Security Advisory and Response

Dell EMC PowerStore versions prior to 1.0.3.0.5.xxx contain a file permission vulnerability that could be exploited by a locally authenticated attacker, potentially leading to the disclosure of certain system directory information.

Understanding CVE-2020-29503

Dell EMC PowerStore is affected by a file permission vulnerability that could allow an attacker to disclose sensitive system directory information.

What is CVE-2020-29503?

This CVE refers to a vulnerability in Dell EMC PowerStore versions before 1.0.3.0.5.xxx that could be exploited by a locally authenticated attacker to access specific system directory information.

The Impact of CVE-2020-29503

The vulnerability has a CVSS base score of 4.1, indicating a medium severity level. It could result in the disclosure of certain system directory information to an attacker with high privileges.

Technical Details of CVE-2020-29503

Dell EMC PowerStore is susceptible to a file permission vulnerability that could have the following implications:

Vulnerability Description

The vulnerability arises from incorrect default permissions in PowerStore versions prior to 1.0.3.0.5.xxx, allowing a locally authenticated attacker to exploit it.

Affected Systems and Versions

Product: PowerStore
Vendor: Dell
Versions Affected: PowerStore SW 1.0.3.0.5.006 and earlier

Exploitation Mechanism

Attack Complexity: High
Attack Vector: Local
Privileges Required: High
Confidentiality Impact: High
Integrity Impact: None
User Interaction: None
Scope: Unchanged
Vector String: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

Mitigation and Prevention

To address CVE-2020-29503, consider the following steps:

Immediate Steps to Take

Update PowerStore to version 1.0.3.0.5.xxx or later.
Monitor system directories for any unauthorized access.

Long-Term Security Practices

Implement the principle of least privilege to restrict access rights.
Conduct regular security audits and vulnerability assessments.

Patching and Updates

Apply security patches and updates provided by Dell to mitigate the vulnerability.