PT-2022-6375 · Dell · Dell Powerscale Onefs

Published 2022-12-22 · Updated 2023-02-08 · CVE-2022-45095

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:L/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Dell PowerScale OneFS versions 8.2.x through 9.4.x

Description The issue is related to a command injection vulnerability. An authenticated user with access to the local shell and the privilege to gather logs from the cluster could potentially exploit this vulnerability, leading to the execution of arbitrary commands, denial of service, information disclosure, and data deletion. The vulnerability is associated with a lack of input data sanitization, which could allow an attacker to execute arbitrary commands, disclose protected information, or cause a denial of service.

Recommendations For Dell PowerScale OneFS versions 8.2.x through 9.4.x, consider disabling local shell access and restricting privileges to gather logs from the cluster until a patch is available. As a temporary workaround, restrict access to sensitive areas of the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2023-01069

CVE-2022-45095

Affected Products

Dell Powerscale Onefs

References · 6

• https://osv.dev/vulnerability/CVE-2022-45095 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45095 · Security Note
• https://dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01069 · Security Note
• https://t.me/cvenotify/43899 · Telegram Post
• https://t.me/cibsecurity/57240 · Telegram Post