TI-2019-02739 Aliases CVE-2019-3720 GHSA-pg4g-ch23-5ch7

Directory traversal in Dell EMC Open Manage System Administrator

LOW 29CWE-22Published 2019-04-25 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

Dell EMC Open Manage System Administrator (OMSA) versions prior to 9.3.0 contain a Directory Traversal Vulnerability. A remote authenticated malicious user with admin privileges could potentially exploit this vulnerability to gain unauthorized access to the file system by exploiting insufficient sanitization of input parameters.

Why it matters now

EPSS 0.0345 89th percentileScored 2026-11-07

Fix Fixed Open Manage System Administrator (Dell EMC): 9.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell EMC	Open Manage System Administrator	9.3 to before 9.3	9.3	Patch available	CNA

Open Manage System Administrator VendorDell EMC Affected 9.3 to before 9.3 Fixed in 9.3 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:dell:emc_openmanage_server_administrator::::::::	before 9.3.0	Vulnerable	Dell

cpe:2.3:a:dell:emc_openmanage_server_administrator:*:*:*:*:*:*:*:* Versions before 9.3.0 Vulnerable ·Dell

Remediation

Fix · CNA Open Manage System Administrator (Dell EMC) Fixed in 9.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2019-04-25
Dell EMC Open Manage System Administrator 9.3
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2019-02740 Improper Range Header Processing VulnerabilityPriority LOW 38
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2019-3720
2026-10-03 Alias added: GHSA-pg4g-ch23-5ch7

References

Advisory 1

https://www.dell.com/support/article/us/en/04/sln316915/dsa-2019-060-dell-emc-open-manage-system-administrator-multiple-vulnerabilities?lang=en

TI-2018-01128 Missing authorization in Dell EMC Avamar, Integrated Data Protection Appliance CVSS 3.0CRITICAL 9.8
TI-2018-01141 OS command injection in Dell EMC RecoverPoint CVSS 3.0CRITICAL 9.8
TI-2018-07852 Dell EMC Avamar and Integrated Data Protection Appliance Remote Code Execution Vulnerability CVSS 3.0CRITICAL 9.8
TI-2017-05620 EMC Networker Remote Code Execution Vulnerability CVSS 3.0CRITICAL 9.8
TI-2018-11243 Dell EMC ESRS Policy Manager versions 6.8 and prior contain a remote code execution… CVSS 3.0CRITICAL 9.8
TI-2017-08041 OS command injection in Dell EMC Data Protection Advisor CVSS 3.1HIGH 8.8

See all 96 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences