PT-2024-2507 · Dell · Dell Powerscale Onefs

Published 2024-03-28 · Updated 2025-01-09 · CVE-2024-25954

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Dell PowerScale OneFS versions 9.5.0.x through 9.7.0.x

Description The issue is related to an insufficient session expiration vulnerability. A remote unauthenticated attacker could potentially exploit this, leading to denial of service.

Recommendations For Dell PowerScale OneFS versions 9.5.0.x through 9.7.0.x, consider implementing additional security measures to mitigate the risk of denial of service attacks until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BDU:2024-02488

CVE-2024-25954

Affected Products

Dell Powerscale Onefs

References · 9

• https://osv.dev/vulnerability/CVE-2024-25954 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25954 · Security Note
• https://dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02488 · Security Note
• https://twitter.com/RedPacketSec/status/1773655247782625650 · Twitter Post
• https://t.me/cvenotify/75019 · Telegram Post
• https://vuldb.com/?id.258566 · Note
• https://t.me/cvenotify/75054 · Telegram Post
• https://twitter.com/CVEnew/status/1773461368731275688 · Twitter Post