PT-2021-11221 · Dell Emc · Dell Emc Powerscale Onefs

Published 2021-02-09 · Updated 2021-02-12 · CVE-2020-26193

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Dell EMC PowerScale OneFS versions 8.1.0 through 9.1.0

Description: The issue is related to improper input validation, allowing a user with the ISI PRIV CLUSTER privilege to execute arbitrary OS commands on the application's underlying OS with the privileges of the vulnerable application.

Recommendations: For Dell EMC PowerScale OneFS versions 8.1.0 through 9.1.0, consider restricting the ISI PRIV CLUSTER privilege to minimize the risk of exploitation until a patch is available.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-20

CWE-78

Related Identifiers

CVE-2020-26193

Affected Products

Dell Emc Powerscale Onefs

References · 4

• https://dell.com/support/kbdoc/en-us/000182873/dsa-2021-009-dell-powerscale-onefs-security-update-for-multiple-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26193 · Security Note
• https://osv.dev/vulnerability/CVE-2020-26193 · Vendor Advisory
• https://t.me/cibsecurity/23334 · Telegram Post