{"id":"CVE-2019-3723","published":"2019-06-06T19:14:38Z","modified":"2024-09-16T19:05:23Z","title":"Web Parameter Tampering Vulnerability","vendor":"Dell EMC","product":"OpenManage Server Administrator","tier":"core","eol":null,"affectedVersions":[{"vendor":"Dell EMC","product":"OpenManage Server Administrator","versions":[">= 9.1.0.3, < 9.1.0.3",">= 9.3.0.4, < 9.3.0.4"]}],"description":{"text":"Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 contain a web parameter tampering vulnerability. A remote unauthenticated attacker could potentially manipulate parameters of web requests to OMSA to create arbitrary files with empty content or delete the contents of any existing file, due to improper input parameter validation","provenance":"source","from":"CVE.org"},"summary":{"text":"The web parameter tampering flaw in Dell EMC OpenManage Server Administrator (OMSA) versions prior to 9.1.0.3 and prior to 9.2.0.4 stems from improper input parameter validation in its web interface. A remote, unauthenticated attacker with network access can manipulate parameters of web requests sent to OMSA to create arbitrary files with empty content or wipe the contents of existing files, with no user interaction or prior authentication required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:22:43Z"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01848,"percentile":0.78996,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.dell.com/support/article/us/en/04/sln317441/dsa-2019-074-dell-emc-openmanage-server-administrator-multiple-vulnerabilities?lang=en","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/108685","tags":["vdb-entry","x_refsource_BID"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"exploitation_technique","evidence":[],"confidence":"high"},{"id":"T1485","name":"Data Destruction","tactics":["impact"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"primary_impact","evidence":[],"confidence":"high"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"secondary_impact","evidence":[],"confidence":"high"},{"id":"T1574","name":"Hijack Execution Flow","tactics":["execution","stealth"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 2)","mappingType":"secondary_impact","evidence":[],"confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-13358","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-13358","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1485"],"provenance":"source"},{"stage":"secondary","techniques":["T1059","T1574"],"provenance":"source"}],"timeline":[{"date":"2019-06-06","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-3723","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":22.2,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":15.8,"detail":"percentile 0.7900"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.37,"detail":"base score 9.1"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}