CVE-2020-5371 High · 8.0 EPSS 1.2%
Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale version 9.0.0 contain a file permissions…
Dell · Isilon OneFS
Official description · CVE.org
Dell EMC Isilon OneFS versions 8.2.2 and earlier and Dell EMC PowerScale version 9.0.0 contain a file permissions vulnerability. An attacker, with network or local file access, could take advantage of insufficiently applied file permissions or gain unauthorized access to files.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
19.0 / 100
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 2/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 6 Jul 2020. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
2 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 2Privilege EscalationTA0004
MITRE CTID mapping of the CVE · primary impact
CollectionTA0009
Data from Local System T1005
MITRE CTID mapping of the CVE · follow-on activity
Detection
0 rules for this CVE · 45 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2020-5371 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Exploitation for Privilege EscalationT106831 general rules
- Exploiting CVE-2019-1388criticalstable
- Audit CVE Eventcriticaltest
- HackTool - SysmonEOP Executioncriticaltest
- InstallerFileTakeOver LPE CVE-2021-41379 File Create Eventcriticaltest
- Possible Coin Miner CPU Priority Paramcriticaltest
- Potential CVE-2021-41379 Exploitation Attemptcriticaltest
- Potential SystemNightmare Exploitation Attemptcriticaltest
- Sudo Privilege Escalation CVE-2019-14287 - Builtincriticaltest
Data from Local SystemT100514 general rules
- OpenCanary - SMB File Open Requesthightest
- Potential Conti Ransomware Database Dumping Activity Via SQLCmdhightest
- SQLite Chromium Profile Data DB Accesshightest
- SQLite Firefox Profile Data DB Accesshightest
- VeeamBackup Database Credentials Dump Via Sqlcmd.EXEhightest
- Script Interpreter Spawning Credential Scanner - Linuxhighexperimental
- Script Interpreter Spawning Credential Scanner - Windowshighexperimental
- Shai-Hulud NPM Package Malicious Exfiltration via Curlhighexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.