7.8

CVE-2022-33923

Dell PowerStore, versions prior to 3.0.0.0, contains an OS Command Injection vulnerability in PowerStore T environment. A locally authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS command on the PowerStore underlying OS. Exploiting may lead to a system take over by an attacker.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dell ≫ Emc Powerstore 500t Firmware Version < 3.0.0.0-1732745
   Dell ≫ Emc Powerstore 500t Version -
Dell ≫ Emc Powerstore 1200t Firmware Version < 3.0.0.0-1732745
   Dell ≫ Emc Powerstore 1200t Version -
Dell ≫ Emc Powerstore 3200t Firmware Version < 3.0.0.0-1732745
   Dell ≫ Emc Powerstore 3200t Version -
Dell ≫ Emc Powerstore 5200t Firmware Version < 3.0.0.0-1732745
   Dell ≫ Emc Powerstore 5200t Version -
Dell ≫ Emc Powerstore 9200t Firmware Version < 3.0.0.0-1732745
   Dell ≫ Emc Powerstore 9200t Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.36% 0.287
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EMC 6.4 0.5 5.9
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://www.dell.com/support/kbdoc/000201283
Patch
Vendor Advisory