CVE-2021-36338 — Client-Side Enforcement of Server-Side Security in Dell Unisphere FOR Powermax

CWE-602 — Client-Side Enforcement of Server-Side SecurityCWE-565 — Reliance on Cookies without Validation and Integrity CheckingCWE-669 — Incorrect Resource Transfer Between Spheres3 documents3 sources
Severity
8.0HIGHNVD
CNA6.3
EPSS
0.1%
top 77.11%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Dell Unisphere FOR PowermaxDell Solutions EnablerDell Solutions Enabler Virtual Appliance+4 more
Timeline
PublishedJan 21
Latest updateJan 22

Description

Unisphere for PowerMax versions prior to 9.2.2.2 contains a privilege escalation vulnerability. An adjacent malicious user could potentially exploit this vulnerability to escalate their privileges and access functionalities they do not have access to. CVE-2022-31233 addresses the partial fix in CVE-2021-36338.

CVSS vector

CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.1 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5dell/unisphere_for_powermaxunspecified — 9.2.2.2
▶NVDdell/unisphere9.2.0.0 — 9.2.3.4+1
▶NVDdell/unisphere_3609.2.0.0 — 9.2.3.3+1
▶NVDdell/vasa9.2.0.0 — 9.2.3.0+1

Patches

Patch: www.dell.com ↗Patch: www.dell.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-g4hc-rpr7-vvcr: Unisphere for PowerMax versions prior to 9↗2022-01-22
▶
CVEList
CVE-2021-36338: Unisphere for PowerMax versions prior to 9↗2022-01-21
▶
CVE-2021-36338 — Dell vulnerability | cvebase