PT-2021-11220 · Dell Emc · Dell Emc Powerscale Onefs

Published 2021-02-09 · Updated 2021-02-12 · CVE-2020-26192

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Dell EMC PowerScale OneFS versions 8.2.0 through 9.1.0

Description: The issue allows a non-admin user with either ISI PRIV LOGIN CONSOLE or ISI PRIV LOGIN SSH privileges to potentially exploit it and read arbitrary data, tamper with system software, or deny service to users. It is noted that no non-admin users or roles have these privileges by default.

Recommendations: For Dell EMC PowerScale OneFS versions 8.2.0 through 9.1.0, consider restricting access to non-admin users with ISI PRIV LOGIN CONSOLE or ISI PRIV LOGIN SSH privileges until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-26192

Affected Products

Dell Emc Powerscale Onefs

References · 4

• https://dell.com/support/kbdoc/en-us/000182873/dsa-2021-009-dell-powerscale-onefs-security-update-for-multiple-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26192 · Security Note
• https://t.me/cibsecurity/23341 · Telegram Post