PT-2021-11219 · Dell Emc · Dell Emc Powerscale Onefs

Published 2021-02-09 · Updated 2021-09-14 · CVE-2020-26191

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Dell EMC PowerScale OneFS versions 8.1.0 through 9.1.0

Description: The issue allows a user with ISI PRIV JOB ENGINE to use the PermissionRepair job and grant themselves the highest level of RBAC privileges. This enables them to read arbitrary data, tamper with system software, or deny service to users.

Recommendations: For Dell EMC PowerScale OneFS versions 8.1.0 through 9.1.0, consider restricting the use of the PermissionRepair job to prevent privilege escalation until a patch is available. Additionally, limit the assignment of ISI PRIV JOB ENGINE to only necessary users to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2020-26191

Affected Products

Dell Emc Powerscale Onefs

References · 4

• https://dell.com/support/kbdoc/en-us/000182873/dsa-2021-009-dell-powerscale-onefs-security-update-for-multiple-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26191 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26191 · Security Note
• https://t.me/cibsecurity/23331 · Telegram Post