{"affected":[{"affectedData":[{"product":"Integrated Dell Remote Access Controller (iDRAC)","vendor":"Dell","versions":[{"lessThan":"4.20.20.20","status":"affected","version":"unspecified","versionType":"custom"}]}],"source":"security_alert@emc.com"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:dell:idrac9_firmware:*:*:*:*:*:*:*:*","matchCriteriaId":"1B64D591-31BA-4D2F-B5A4-00529C25EDC7","versionEndExcluding":"4.20.20.20","vulnerable":true}],"negate":false,"operator":"OR"},{"cpeMatch":[{"criteria":"cpe:2.3:h:dell:idrac9:-:*:*:*:*:*:*:*","matchCriteriaId":"BD8B684E-092F-496C-9D94-51CCD1F3575A","vulnerable":false}],"negate":false,"operator":"OR"}],"operator":"AND"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Dell EMC iDRAC9 versions prior to 4.20.20.20 contain a Path Traversal Vulnerability. A remote authenticated malicious user with low privileges could potentially exploit this vulnerability by manipulating input parameters to gain unauthorized read access to the arbitrary files."},{"lang":"es","value":"Dell EMC iDRAC9 versiones anteriores a 4.20.20.20, contienen una vulnerabilidad de Salto de Ruta. Un usuario malicioso autenticado remoto con pocos privilegios podría explotar esta vulnerabilidad al manipular los parámetros de entrada para conseguir acceso de lectura no autorizado a los archivos arbitrarios"}],"id":"CVE-2020-5366","lastModified":"2026-06-17T03:21:21.750","metrics":{"cvssMetricV2":[{"acInsufInfo":false,"baseSeverity":"MEDIUM","cvssData":{"accessComplexity":"LOW","accessVector":"NETWORK","authentication":"SINGLE","availabilityImpact":"NONE","baseScore":4.0,"confidentialityImpact":"PARTIAL","integrityImpact":"NONE","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","version":"2.0"},"exploitabilityScore":8.0,"impactScore":2.9,"obtainAllPrivilege":false,"obtainOtherPrivilege":false,"obtainUserPrivilege":false,"source":"nvd@nist.gov","type":"Primary","userInteractionRequired":false}],"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":7.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.2,"source":"security_alert@emc.com","type":"Secondary"},{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":3.6,"source":"nvd@nist.gov","type":"Primary"}]},"published":"2020-07-09T14:15:10.793","references":[{"source":"security_alert@emc.com","tags":["Vendor Advisory"],"url":"https://www.dell.com/support/article/en-us/sln322125/dsa-2020-128-idrac-local-file-inclusion-vulnerability?lang=en"},{"source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"url":"https://www.dell.com/support/article/en-us/sln322125/dsa-2020-128-idrac-local-file-inclusion-vulnerability?lang=en"}],"sourceIdentifier":"security_alert@emc.com","vulnStatus":"Modified","weaknesses":[{"description":[{"lang":"en","value":"CWE-22"}],"source":"security_alert@emc.com","type":"Secondary"},{"description":[{"lang":"en","value":"CWE-22"}],"source":"nvd@nist.gov","type":"Primary"}]}