CVE-2020-26191: Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain a privilege escalation vulnerability. A user with ISI_PRIV_JOB_ENGINE may use the PermissionRepair job…

PriorityP340high7.8CVSS 3.1

AVLACLPRLUINSUCHIHAH

EPSS

0.29%

21.2th percentile

Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain a privilege escalation vulnerability. A user with ISI_PRIV_JOB_ENGINE may use the PermissionRepair job to grant themselves the highest level of RBAC privileges thus being able to read arbitrary data, tamper with system software or deny service to users.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
dell	emc_powerscale_onefs	—	—
dell	emc_powerscale_onefs	—	—
dell	emc_powerscale_onefs	—	—
dell	emc_powerscale_onefs	—	—
dell	emc_powerscale_onefs	—	—
dell	emc_powerscale_onefs	—	—
dell	emc_powerscale_onefs	—	—
dell	emc_powerscale_onefs	—	—
dell	powerscale_onefs	>= unspecified < 8.1.2, 8.2.2, 9.1.0+	8.1.2, 8.2.2, 9.1.0+

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.