PT-2022-22168 · Dell · Dell Powerscale Onefs

Published 2022-10-21 · Updated 2022-10-24 · CVE-2022-34437

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell PowerScale OneFS versions 8.2.2 through 9.3.0

Description The issue is an OS command injection vulnerability that could be exploited by a privileged local malicious user, potentially leading to a full system compromise. This vulnerability impacts compliance mode clusters.

Recommendations For Dell PowerScale OneFS versions 8.2.2 through 9.3.0, consider restricting access to the system to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling any functionality that allows for OS command execution until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-34437

Affected Products

Dell Powerscale Onefs

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2022-34437 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34437 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000204053/dsa-2022-245-dell-emc-powerscale-onefs-security-update-for-multiple-security-updates · Vendor Advisory
• https://t.me/cibsecurity/51950 · Telegram Post