PT-2022-6324 · Dell · Dell Powerscale Onefs

Published 2022-11-09 · Updated 2023-02-08 · CVE-2022-45099

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell PowerScale OneFS versions 8.2.x through 9.4.x

Description The issue is related to a weak encoding for a NDMP password in Dell PowerScale OneFS. A malicious and privileged local attacker could potentially exploit this, leading to a full system compromise. The vulnerability is associated with weak cryptography of the NDMP password, which may allow an attacker to gain full control over the system.

Recommendations For versions 8.2.x through 9.4.x, consider disabling the NDMP password feature until a patch is available to prevent potential exploitation. Restrict access to privileged local accounts to minimize the risk of exploitation. Avoid using weak passwords for NDMP to reduce the risk of compromise. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Default Permissions

Weakness Enumeration

CWE-276

CWE-261

Related Identifiers

BDU:2023-00905

CVE-2022-45099

Affected Products

Dell Powerscale Onefs

References · 6

• https://bdu.fstec.ru/vul/2023-00905 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-45099 · Security Note
• https://dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-45099 · Vendor Advisory
• https://t.me/cibsecurity/57260 · Telegram Post
• https://vuldb.com/?id.219918 · Note