PT-2021-21195 · Dell Emc · Dell Emc Powerscale Onefs

Published 2021-08-16 · Updated 2022-10-06 · CVE-2021-36278

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC PowerScale OneFS versions 8.2.x through 9.1.1.1

Description The issue concerns the exposure of sensitive information in log files. A local malicious user with specific privileges, such as ISI PRIV LOGIN SSH, ISI PRIV LOGIN CONSOLE, or ISI PRIV SYS SUPPORT, may exploit this to access sensitive information. If third-party systems consume these logs, they will also have access to the same sensitive information.

Recommendations For Dell EMC PowerScale OneFS versions 8.2.x through 9.1.1.1, consider restricting access to log files to minimize the risk of sensitive information exposure until a patch is available. As a temporary workaround, limit privileges to only those necessary for each user, reducing the potential for exploitation by malicious actors with ISI PRIV LOGIN SSH, ISI PRIV LOGIN CONSOLE, or ISI PRIV SYS SUPPORT privileges.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2021-36278

Affected Products

Dell Emc Powerscale Onefs

References · 5

• https://osv.dev/vulnerability/CVE-2021-36278 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36278 · Security Note
• https://dell.com/support/kbdoc/000190408 · Vendor Advisory
• https://t.me/cvenotify/19504 · Telegram Post
• https://t.me/cvenotify/19486 · Telegram Post