PT-2024-2552 · Dell · Dell Powerscale Onefs

Published 2024-02-13 · Updated 2025-01-09 · CVE-2024-25959

Positive Technologies (AI Summary)

CVSS v3.1

7.9

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x

Description The issue is related to the insertion of sensitive information into log files, which could be exploited by a low-privileged local attacker. This exploitation may lead to the disclosure of sensitive information or escalation of privileges. The vulnerability impacts various OneFS functions and could potentially allow an attacker to reveal protected information or increase their privileges.

Recommendations For Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x, patch immediately to fix the vulnerability. As a temporary workaround, consider restricting log access to minimize the risk of exploitation. Monitor for updates and apply them as soon as they become available to ensure the issue is fully resolved.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

BDU:2024-02560

CVE-2024-25959

Affected Products

Dell Powerscale Onefs

References · 11

• https://bdu.fstec.ru/vul/2024-02560 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25959 · Vendor Advisory
• https://dell.com/support/kbdoc/en-us/000223366/dsa-2024-115-security-update-for-dell-powerscale-onefs-for-multiple-security-vulnerabilities · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-25959 · Security Note
• https://t.me/cvenotify/75049 · Telegram Post
• https://t.me/cvenotify/75012 · Telegram Post
• https://vuldb.com/?id.258560 · Note
• https://twitter.com/RedPacketSec/status/1773655239305875782 · Twitter Post
• https://t.me/cvenotify/106943 · Telegram Post
• https://twitter.com/CVEnew/status/1773461377329602742 · Twitter Post
• https://twitter.com/oktsec/status/1776022384220295483 · Twitter Post