PT-2022-15525 · Dell · Powerstore

Published 2022-06-02 · Updated 2023-07-24 · CVE-2022-22557

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PowerStore versions 2.0.0.x through 2.0.1.x

Description The issue is related to plain-text password storage in PowerStore X & T environments. A locally authenticated attacker could exploit this, leading to the disclosure of certain user credentials. The attacker may use the exposed credentials to access the vulnerable application with privileges of the compromised account.

Recommendations For versions 2.0.0.x and 2.0.1.x, consider restricting access to sensitive areas of the application until a fix is available. As a temporary workaround, avoid using plain-text password storage in PowerStore X & T environments. Restrict privileges of compromised accounts to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

CVE-2022-22557

Affected Products

Powerstore

References · 5

• https://osv.dev/vulnerability/CVE-2022-22557 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22557 · Security Note
• https://dell.com/support/kbdoc/000196367 · Vendor Advisory
• https://t.me/cvenotify/31061 · Telegram Post
• https://t.me/cibsecurity/43780 · Telegram Post