PT-2022-6365 · Dell · Dell Powerscale Onefs

Published 2022-12-13 · Updated 2023-02-08 · CVE-2022-45098

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Dell PowerScale OneFS versions 9.0.0.x through 9.4.0.x

Description The issue is related to the cleartext storage of sensitive information in the S3 component, potentially leading to information disclosure. An authenticated local attacker could exploit this, resulting in unauthorized access to protected information. The vulnerability is associated with the disclosure of information through log files.

Recommendations For versions 9.0.0.x through 9.4.0.x, consider restricting access to the S3 component until a patch is available. As a temporary workaround, limit the use of the S3 component to minimize the risk of exploitation.

Fix

Insertion into Log File

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-532

CWE-312

Related Identifiers

BDU:2023-01053

CVE-2022-45098

Affected Products

Dell Powerscale Onefs

References · 6

• https://osv.dev/vulnerability/CVE-2022-45098 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45098 · Security Note
• https://bdu.fstec.ru/vul/2023-01053 · Security Note
• https://t.me/cibsecurity/57270 · Telegram Post
• https://t.me/cvenotify/43884 · Telegram Post