PT-2022-18114 · Dell · Powerstore Sw

Published 2022-06-02 · Updated 2022-06-13 · CVE-2022-26867

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PowerStore SW version 2.1.1.0

Description The issue allows a malicious, authenticated user to inject payloads into CSV or XLSX files exported from PowerStore SW. These payloads might be interpreted as formulas by the corresponding spreadsheet application, potentially leading to malicious actions. The data is taken as is, without any validation or sanitization.

Recommendations For PowerStore SW version 2.1.1.0, consider validating and sanitizing the data before exporting it to CSV or XLSX files to prevent malicious payload injection. As a temporary workaround, restrict the use of the export feature to trusted users only, and ensure that the spreadsheet applications used to open these files are configured to warn users about potential formula injections.

Fix

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2022-26867

Affected Products

Powerstore Sw

References · 5

• https://osv.dev/vulnerability/CVE-2022-26867 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-26867 · Security Note
• https://dell.com/support/kbdoc/000196367 · Vendor Advisory
• https://t.me/cibsecurity/43775 · Telegram Post
• https://t.me/cvenotify/31059 · Telegram Post