Dell EMC OpenManage Enterprise (OME) versions prior to 3.2 and OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a SQL injection vulnerability. A remote authenticated malicious u

Successful exploitation of CVE-2020-5320 could grant an attacker unauthorized access to sensitive data stored within the OpenManage Enterprise database. An attacker could potentially read, modify, or delete data, including user credentials, system configurations, and performance metrics. The ability to execute arbitrary SQL commands also opens the door to privilege escalation, allowing the attacker to gain control over the entire system. While the vulnerability requires authentication with high privileges, the potential impact is significant, particularly in environments where OME is used for centralized management and monitoring of critical infrastructure.

Organizations utilizing Dell EMC OpenManage Enterprise for server management and monitoring are at risk, particularly those running versions prior to 3.20. Environments with shared hosting configurations or legacy systems with outdated software versions are especially vulnerable. Administrators who have not implemented robust access controls and input validation measures are also at increased risk.

• dell / server:

journalctl -u openmanage_enterprise | grep -i "SQL injection"

• generic web:

curl -I 'https://<ome_ip>/<vulnerable_endpoint>' | grep 'SQL injection'

1. 2020-07-16Discovery

   discovery

2. 2021-07-19Disclosure

   disclosure

3. 2021-07-19Patch

   patch

1. 已保留2020-01-03
2. 发布日期2021-07-19
3. 修改日期2024-09-16
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2020-5320 is to upgrade to Dell EMC OpenManage Enterprise version 3.20 or later. If immediate upgrade is not possible, consider restricting access to the vulnerable endpoints and implementing strict input validation to prevent SQL injection attempts. Review existing user accounts and permissions to ensure that only authorized personnel have access to the OME interface. Monitor system logs for suspicious SQL activity and implement a Web Application Firewall (WAF) with SQL injection protection rules. After upgrade, confirm the vulnerability is resolved by attempting a SQL injection attack on the vulnerable endpoint and verifying that it is blocked.