CVE-2025-21120

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-21120", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "state": "PUBLISHED", "assignerShortName": "dell", "dateReserved": "2024-11-23T06:04:00.843Z", "datePublished": "2025-08-04T18:33:07.220Z", "dateUpdated": "2026-02-26T17:49:58.914Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Avamar Server", "vendor": "Dell", "versions": [{"lessThan": "19.10 SP1 with CHF 338904 or later", "status": "affected", "version": "19.8 through 19.10", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Avamar Virtual Edition", "vendor": "Dell", "versions": [{"lessThan": "19.10 SP1 with CHF 338904 or later", "status": "affected", "version": "19.8 through 19.10", "versionType": "semver"}]}], "datePublic": "2025-07-21T17:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Dell Avamar, versions prior to 19.10 SP1 with patch 338904, contains a Trusting HTTP Permission Methods on the Server-Side vulnerability in Security. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure."}], "value": "Dell Avamar, versions prior to 19.10 SP1 with patch 338904, contains a Trusting HTTP Permission Methods on the Server-Side vulnerability in Security. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-650", "description": "CWE-650: Trusting HTTP Permission Methods on the Server Side", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-02-18T15:48:05.184Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000347698/dsa-2025-271-security-update-for-dell-avamar-and-dell-avamar-virtual-edition-multiple-vulnerabilities"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21120", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-07T03:55:26.678375Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T17:49:58.914Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-21120", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-07T03:55:26.678375Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T19:16:53.698Z"}}], "cna": {"source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dell", "product": "Avamar Server", "versions": [{"status": "affected", "version": "19.8 through 19.10", "lessThan": "19.10 SP1 with CHF 338904 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Dell", "product": "Avamar Virtual Edition", "versions": [{"status": "affected", "version": "19.8 through 19.10", "lessThan": "19.10 SP1 with CHF 338904 or later", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2025-07-21T17:00:00.000Z", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000347698/dsa-2025-271-security-update-for-dell-avamar-and-dell-avamar-virtual-edition-multiple-vulnerabilities", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Dell Avamar, versions prior to 19.10 SP1 with patch 338904, contains a Trusting HTTP Permission Methods on the Server-Side vulnerability in Security. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.", "supportingMedia": [{"type": "text/html", "value": "Dell Avamar, versions prior to 19.10 SP1 with patch 338904, contains a Trusting HTTP Permission Methods on the Server-Side vulnerability in Security. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-650", "description": "CWE-650: Trusting HTTP Permission Methods on the Server Side"}]}], "providerMetadata": {"orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell", "dateUpdated": "2026-02-18T15:48:05.184Z"}}}, "cveMetadata": {"cveId": "CVE-2025-21120", "state": "PUBLISHED", "dateUpdated": "2026-02-26T17:49:58.914Z", "dateReserved": "2024-11-23T06:04:00.843Z", "assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "datePublished": "2025-08-04T18:33:07.220Z", "assignerShortName": "dell"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Avamar Server", "vendor": "Dell", "versions": [{"lessThan": "19.10 SP1 with CHF 338904 or later", "status": "affected", "version": "19.8 through 19.10", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Avamar Virtual Edition", "vendor": "Dell", "versions": [{"lessThan": "19.10 SP1 with CHF 338904 or later", "status": "affected", "version": "19.8 through 19.10", "versionType": "semver"}]}], "source": "security_alert@emc.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:avamar:19.4:*:*:*:virtual:esxi:*:*", "matchCriteriaId": "4793C917-302E-4ACD-A648-7D87BB79420C", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.4:*:*:*:virtual:vmware:*:*", "matchCriteriaId": "0F134C17-57A7-4501-BAC6-44D684B40274", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.4:*:*:*:virtual:vsphere:*:*", "matchCriteriaId": "C2AA1AF6-BBEB-474B-BFDF-65BDA31A0BEF", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.7:*:*:*:virtual:esxi:*:*", "matchCriteriaId": "7323A49B-13FA-46F0-8436-32048778B2D3", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.7:*:*:*:virtual:vmware:*:*", "matchCriteriaId": "AAD1F4F9-0475-4577-B999-F7A37ADCBE85", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.7:*:*:*:virtual:vsphere:*:*", "matchCriteriaId": "8997C078-ABE6-4E5B-8196-B2EC50E93402", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.8:*:*:*:virtual:esxi:*:*", "matchCriteriaId": "00E6EB2D-8D7E-4976-9759-EEC9F7521F92", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.8:*:*:*:virtual:vmware:*:*", "matchCriteriaId": "3B112013-C0CF-45C5-A4FF-8B8D4D56B18E", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.8:*:*:*:virtual:vsphere:*:*", "matchCriteriaId": "9E4DFB88-112F-4BC9-8CED-72AE1B508B62", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.9:*:*:*:virtual:esxi:*:*", "matchCriteriaId": "D2E97D6E-1B0B-42D2-B815-9C6832B70332", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.9:*:*:*:virtual:vmware:*:*", "matchCriteriaId": "70E453E0-248B-406B-9493-91B956FDC0C7", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.9:*:*:*:virtual:vsphere:*:*", "matchCriteriaId": "DFF960D2-6E01-4E78-ADE5-11352CAE4730", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.10:-:*:*:virtual:esxi:*:*", "matchCriteriaId": "B4DF4788-34D6-4EF5-B7F4-A0EEFFB18D75", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.10:-:*:*:virtual:vmware:*:*", "matchCriteriaId": "EA32AB1C-4FB3-4C06-8FFE-1E81CCD8ED57", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.10:-:*:*:virtual:vsphere:*:*", "matchCriteriaId": "3F790002-847B-4AE3-86D3-62B8B54875E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.10:sp1:*:*:virtual:esxi:*:*", "matchCriteriaId": "29E8D84D-473C-4A78-9D77-72E09C29AF2C", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.10:sp1:*:*:virtual:vmware:*:*", "matchCriteriaId": "EB62B466-DD2D-4731-8643-43A254BC0BF8", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.10:sp1:*:*:virtual:vsphere:*:*", "matchCriteriaId": "BB51EA7E-E7A2-45B2-BBE9-8F9847EA6F2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.12:*:*:*:virtual:esxi:*:*", "matchCriteriaId": "ACA48457-DD33-4A0A-8A6D-616FAE085375", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.12:*:*:*:virtual:vmware:*:*", "matchCriteriaId": "5FFD635A-85B8-4BA9-8514-1360D3021111", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:avamar:19.12:*:*:*:virtual:vsphere:*:*", "matchCriteriaId": "E4EEAF2A-6F75-4D8C-B3A6-E3E35FAAD11F", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dell Avamar, versions prior to 19.10 SP1 with patch 338904, contains a Trusting HTTP Permission Methods on the Server-Side vulnerability in Security. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure."}, {"lang": "es", "value": "Dell Avamar, versiones anteriores a la 19.12 con el parche 338905, excepto la versi\u00f3n 19.10SP1 con el parche 338904, contiene una vulnerabilidad de seguridad relacionada con los m\u00e9todos de permisos HTTP de confianza en el servidor. Un atacante con pocos privilegios y acceso remoto podr\u00eda explotar esta vulnerabilidad, lo que provocar\u00eda la exposici\u00f3n de informaci\u00f3n."}], "id": "CVE-2025-21120", "lastModified": "2026-06-17T08:42:37.753", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.5, "source": "security_alert@emc.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-21120", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-08-07T03:55:26.678375Z", "version": "2.0.3"}}]}, "published": "2025-08-04T19:15:30.210", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000347698/dsa-2025-271-security-update-for-dell-avamar-and-dell-avamar-virtual-edition-multiple-vulnerabilities"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-650"}], "source": "security_alert@emc.com", "type": "Secondary"}]}

{}

{"created": "2025-08-05T11:38:54.409168+00:00", "updated": "2025-08-05T11:38:54.409221+00:00", "vendors": ["dell", "dell$PRODUCT$avamar_data_store", "dell$PRODUCT$avamar_server"]}