PT-2022-16679 · Dell · Powerscale Onefs

Published 2022-04-12 · Updated 2022-04-20 · CVE-2022-24411

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell PowerScale OneFS versions 8.2.2 and above

Description A local attacker with ISI PRIV LOGIN SSH and/or ISI PRIV LOGIN CONSOLE could potentially exploit this issue, leading to elevation of privilege. This could potentially allow users to circumvent PowerScale Compliance Mode guarantees.

Recommendations For versions 8.2.2 and above, consider restricting access to ISI PRIV LOGIN SSH and ISI PRIV LOGIN CONSOLE privileges until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

CWE-378

Related Identifiers

CVE-2022-24411

Affected Products

Powerscale Onefs

References · 5

• https://osv.dev/vulnerability/CVE-2022-24411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24411 · Security Note
• https://dell.com/support/kbdoc/000196657 · Vendor Advisory
• https://t.me/cibsecurity/40673 · Telegram Post
• https://t.me/cvenotify/28775 · Telegram Post