PT-2023-12037 · Dell Emc · Dell Emc Unisphere For Vmax Virtual Appliance+2
Thorsten Tüllmann
·
Published
2023-03-17
·
Updated
2023-03-24
·
CVE-2021-21548
CVSS v3.1
7.4
High
| Vector | AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Dell EMC Unisphere for PowerMax versions prior to 9.1.0.27
Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.27
PowerMax OS Release 5978
Description
The issue is related to an improper certificate validation, which could allow an unauthenticated remote attacker to carry out a man-in-the-middle attack. This is done by supplying a crafted certificate, enabling the attacker to intercept the victim's traffic, view, or modify a victim’s data in transit.
Recommendations
For Dell EMC Unisphere for PowerMax versions prior to 9.1.0.27, update to version 9.1.0.27 or later.
For Dell EMC Unisphere for PowerMax Virtual Appliance versions prior to 9.1.0.27, update to version 9.1.0.27 or later.
For PowerMax OS Release 5978, update to a release that includes the fix for this issue.
As a temporary workaround, consider restricting access to sensitive data and implementing additional security measures to detect and prevent man-in-the-middle attacks until a patch is available.
Fix
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Dell Emc Unisphere For Powermax
Dell Emc Unisphere For Vmax Virtual Appliance
Powermax Os