PT-2022-22149 · Dell · Dell Powerscale Onefs

Published 2022-09-02 · Updated 2023-08-08 · CVE-2022-34371

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell PowerScale OneFS versions 9.0.0 up to and including 9.1.0.19 Dell PowerScale OneFS version 9.2.1.12 Dell PowerScale OneFS version 9.3.0.6 Dell PowerScale OneFS version 9.4.0.3

Description The issue concerns an unprotected transport of credentials, which could be exploited by a malicious unprivileged network attacker, potentially leading to full system compromise.

Recommendations For versions 9.0.0 up to and including 9.1.0.19, consider applying a patch or configuration change to protect credential transport. For version 9.2.1.12, consider applying a patch or configuration change to protect credential transport. For version 9.3.0.6, consider applying a patch or configuration change to protect credential transport. For version 9.4.0.3, consider applying a patch or configuration change to protect credential transport. As a temporary workaround, consider restricting network access to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-34371

Affected Products

Dell Powerscale Onefs

References · 5

• https://dell.com/support/kbdoc/en-us/000202171/dsa-2022-172-dell-powerscale-onefs-security-update-for-multiple-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34371 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34371 · Security Note
• https://t.me/cvenotify/35650 · Telegram Post
• https://t.me/cibsecurity/49256 · Telegram Post