PT-2022-6220 · Dell · Dell Powerscale Onefs

Published 2022-06-30 · Updated 2022-10-24 · CVE-2022-31239

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell PowerScale OneFS versions 9.0.0 through 9.1.0.19 Dell PowerScale OneFS version 9.2.1.12 Dell PowerScale OneFS version 9.3.0.6

Description The issue is related to the disclosure of sensitive information through log files in the PowerScale OneFS operating system. A privileged local user may potentially exploit this, leading to the disclosure of protected information.

Recommendations For Dell PowerScale OneFS versions 9.0.0 through 9.1.0.19, consider restricting access to log files to minimize the risk of sensitive data disclosure. For Dell PowerScale OneFS version 9.2.1.12, restrict access to log files until a patch is available. For Dell PowerScale OneFS version 9.3.0.6, avoid using log files that may contain sensitive data until the issue is resolved.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2023-00497

CVE-2022-31239

Affected Products

Dell Powerscale Onefs

References · 5

• https://dell.com/support/kbdoc/en-us/000201094/dsa-2022-149-dell-emc-powerscale-onefs-security-update?lang=en · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31239 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31239 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00497 · Security Note
• https://t.me/cibsecurity/51951 · Telegram Post