6.7
CVE-2022-45095
- EPSS 0.08%
- Veröffentlicht 01.02.2023 05:15:12
- Zuletzt bearbeitet 21.11.2024 07:28:46
- Quelle security_alert@emc.com
- Teams Watchlist Login
- Unerledigt Login
Dell PowerScale OneFS, 8.2.x-9.4.x, contain a command injection vulnerability. An authenticated user having access local shell and having the privilege to gather logs from the cluster could potentially exploit this vulnerability, leading to execute arbitrary commands, denial of service, information disclosure, and data deletion.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Dell ≫ Emc Powerscale Onefs Version >= 9.1.0.0 < 9.1.0.25
Dell ≫ Emc Powerscale Onefs Version >= 9.2.1.0 < 9.2.1.18
Dell ≫ Emc Powerscale Onefs Version >= 9.4.0.0 < 9.4.0.9
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.08% | 0.231 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 6.7 | 0.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
| security_alert@emc.com | 6.7 | 0.8 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
|
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.