PT-2023-20373 · Dell · Dell Powerscale Onefs

CVE-2023-25940 · Publicado 2023-04-04 · Atualizado 2023-06-22

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell PowerScale OneFS version 9.5.0.0

Description The issue is related to improper link resolution before file access in the isi gather info function. A local attacker, potentially with low privileges, could exploit this, leading to system takeover and breaking compliance mode guarantees.

Recommendations For Dell PowerScale OneFS version 9.5.0.0, consider restricting access to the isi gather info function until a patch is available. Additionally, review system configurations to minimize the risk of exploitation by low-privileged users. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Link Following

Enumeração de Fraquezas

CWE-59

Identificadores relacionados

CVE-2023-25940

Produtos afetados

Dell Powerscale Onefs

Referências · 6

• https://t.me/cvenotify/52871 · Publicação no Telegram
• https://dell.com/support/kbdoc/en-us/000211539/dell-emc-powerscale-onefs-security · Aviso do Fabricante
• https://t.me/cvenotify/47482 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-25940 · Nota de Segurança
• https://t.me/cibsecurity/61376 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-25940 · Aviso do Fabricante