Improper privilege management in Dell Avamar
Priority LOW 33CWE-269Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-269.
Summary
Dell EMC Avamar Server versions 18.2, 19.1, 19.2, 19.3, and 19.4 contain an improper privilege management vulnerability in AUI. A malicious user with high privileges could potentially exploit this vulnerability, leading to the disclosure of the AUI info and performing some unauthorized operation on the AUI.
Why it matters now
EPSS 0.00772 55th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | Avamar | 18.2, 19.1, 19.2, 19.3, 19.4 | — | No fix listed | CNA |
- Avamar VendorDell Affected 18.2, 19.1, 19.2, 19.3, 19.4 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:dell:emc_avamar_server:18.2:*:*:*:*:*:*:* | 18.2 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_avamar_server:19.1:*:*:*:*:*:*:* | 19.1 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_avamar_server:19.2:*:*:*:*:*:*:* | 19.2 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_avamar_server:19.3:*:*:*:*:*:*:* | 19.3 | Vulnerable | Dell |
| cpe:2.3:a:dell:emc_avamar_server:19.4:*:*:*:*:*:*:* | 19.4 | Vulnerable | Dell |
- cpe:2.3:a:dell:emc_avamar_server:18.2:*:*:*:*:*:*:* Versions 18.2 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_avamar_server:19.1:*:*:*:*:*:*:* Versions 19.1 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_avamar_server:19.2:*:*:*:*:*:*:* Versions 19.2 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_avamar_server:19.3:*:*:*:*:*:*:* Versions 19.3 Vulnerable ·Dell
- cpe:2.3:a:dell:emc_avamar_server:19.4:*:*:*:*:*:*:* Versions 19.4 Vulnerable ·Dell
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-36316
- 2026-10-03 Alias added: GHSA-wrmw-qgfp-5p47
References
More Dell Emc Avamar Server vulnerabilities
- TI-2020-17716 Path traversal in Dell Avamar CVSS 3.1CRITICAL 10.0
- TI-2020-04393 Deserialization of untrusted data in Dell Avamar Virtual Edition CVSS 3.1CRITICAL 9.8
- TI-2020-17714 SQL injection in Dell Avamar CVSS 3.1CRITICAL 10.0
- TI-2020-17715 Path traversal in Dell Avamar CVSS 3.1HIGH 8.7
- TI-2019-02780 Incorrect permission assignment in Dell Avamar CVSS 3.1HIGH 8.1
- TI-2019-02769 XML external entity injection in Dell Avamar CVSS 3.1HIGH 8.2
Sources
- CVE-2021-36316 · CVE Program
- CVE-2021-36316 · NVD
- FIRST EPSS
- GHSA-wrmw-qgfp-5p47 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences