PT-2022-6313 · Dell · Dell Container Storage Modules

Published 2022-09-15 · Updated 2022-10-13 · CVE-2022-34427

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell Container Storage Modules version 1.2

Description The issue is related to an OS Command Injection in the goiscsi and gobrick libraries. A remote unauthenticated attacker could exploit this, leading to modification of intended OS command execution. Additionally, it is described as a vulnerability related to an uncontrolled DLL search path, which could allow a remote attacker to execute arbitrary code.

Recommendations For Dell Container Storage Modules version 1.2, consider disabling the goiscsi and gobrick libraries as a temporary workaround until a patch is available. Restrict access to the affected libraries to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-00825

CVE-2022-34427

Affected Products

Dell Container Storage Modules

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-34427 · Security Note
• https://bdu.fstec.ru/vul/2023-00825 · Security Note
• https://dell.com/support/kbdoc/en-vc/000203352/dsa-2022-259-dell-container-storage-modules-security-update-for-multiple-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34427 · Vendor Advisory
• https://dell.com/support/kbdoc/ru-ru/000203352/dsa-2022-259-dell-container-storage-modules-security-update-for-multiple-vulnerabilities · Note
• https://t.me/cibsecurity/51136 · Telegram Post