CVE-2021-21502 — Improper Authentication in Dell Powerscale Onefs

CWE-287 — Improper AuthenticationCWE-269 — Improper Privilege Management3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
0.3%
top 49.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Dell Powerscale OnefsDell EMC Powerscale Onefs
Timeline
PublishedFeb 9
Latest updateMay 24

Description

Dell PowerScale OneFS versions 8.1.0 – 9.1.0 contain a "use of SSH key past account expiration" vulnerability. A user on the network with the ISI_PRIV_AUTH_SSH RBAC privilege that has an expired account may potentially exploit this vulnerability, giving them access to the same things they had before account expiration. This may by a high privileged account and hence Dell recommends customers upgrade at the earliest opportunity.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5dell/powerscale_onefsunspecified — 8.1.2 / 8.2.2 / 9.1.0.x / Empire / Main
▶NVDdell/emc_powerscale_onefs8 versions+7

🔴Vulnerability Details

2
GHSA
GHSA-pw6f-fxqf-2vxp: Dell PowerScale OneFS versions 8↗2022-05-24
▶
CVEList
CVE-2021-21502: Dell PowerScale OneFS versions 8↗2021-02-09
▶
CVE-2021-21502 — Improper Authentication in Dell | cvebase