TI-2020-04407 Aliases CVE-2020-5356 GHSA-f5jv-3q57-gqc5

Improper authorization in Dell Power Protect Data Manager

LOW 36CWE-285Published 2020-07-06 · Updated 2024-09-16

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass, Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-285 and CWE-552.

Summary

Dell PowerProtect Data Manager (PPDM) versions prior to 19.4 and Dell PowerProtect X400 versions prior to 3.2 contain an improper authorization vulnerability. A remote authenticated malicious user may download any file from the affected PowerProtect virtual machines.

Why it matters now

EPSS 0.01273 70th percentileScored 2026-11-07

Fix Fixed Power Protect Data Manager (Dell): PowerProtect Data Manager version 19.5

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dell	Power Protect Data Manager	before PowerProtect Data Manager version 19.5	PowerProtect Data Manager version 19.5	Patch available	CNA

Power Protect Data Manager VendorDell Affected before PowerProtect Data Manager version 19.5 Fixed in PowerProtect Data Manager version 19.5 Patch available CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:dell:powerprotect_data_manager::::::::	before 19.4	Vulnerable	Dell
cpe:2.3:o:dell:powerprotect_x400_firmware::::::::	before 3.2	Vulnerable	Dell
cpe:2.3:h:dell:powerprotect_x400:-:::::::*	not specified by NVD	Running on	Dell

cpe:2.3:a:dell:powerprotect_data_manager:*:*:*:*:*:*:*:* Versions before 19.4 Vulnerable ·Dell
cpe:2.3:o:dell:powerprotect_x400_firmware:*:*:*:*:*:*:*:* Versions before 3.2 Vulnerable ·Dell
cpe:2.3:h:dell:powerprotect_x400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Dell

Remediation

Fix · CNA Power Protect Data Manager (Dell) Fixed in PowerProtect Data Manager version 19.5

Timeline

2026-10-02 Threatist record created from CVE-2020-5356
2026-10-03 Alias added: GHSA-f5jv-3q57-gqc5

References

Advisory 1

https://www.dell.com/support/security/en-us/details/544733/DSA-2020-099-Dell-PowerProtect-Data-Manager-Improper-Authorization-Vulnerability

TI-2026-34362 Improper input validation in Dell PowerProtect Data Manager CVSS 3.1CRITICAL 9.1
TI-2026-29383 Improper input validation in Dell PowerProtect Data Manager CVSS 3.1CRITICAL 9.1
TI-2024-15023 Weak password recovery in Dell PowerProtect Data Manager CVSS 3.1HIGH 8.8
TI-2023-12643 Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control… CVSS 3.1HIGH 8.8
TI-2026-36649 Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of… CVSS 3.1HIGH 8.8
TI-2026-17877 Dell PowerProtect Data Manager, version(s) prior to 19.22, contain(s) an Incorrect… CVSS 3.1HIGH 8.8

See all 30 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences