CVE Vulnerabilities

CVE-2020-26191

Improper Privilege Management

Published: Feb 09, 2021 | Modified: Nov 21, 2024
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
4.6 MEDIUM
AV:L/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu

Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain a privilege escalation vulnerability. A user with ISI_PRIV_JOB_ENGINE may use the PermissionRepair job to grant themselves the highest level of RBAC privileges thus being able to read arbitrary data, tamper with system software or deny service to users.

Weakness 

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Software 

Name Vendor Start Version End Version
Emc_powerscale_onefs Dell 8.1.0 (including) 8.1.0 (including)
Emc_powerscale_onefs Dell 8.1.1 (including) 8.1.1 (including)
Emc_powerscale_onefs Dell 8.1.2 (including) 8.1.2 (including)
Emc_powerscale_onefs Dell 8.2.0 (including) 8.2.0 (including)
Emc_powerscale_onefs Dell 8.2.1 (including) 8.2.1 (including)
Emc_powerscale_onefs Dell 8.2.2 (including) 8.2.2 (including)
Emc_powerscale_onefs Dell 9.0.0 (including) 9.0.0 (including)
Emc_powerscale_onefs Dell 9.1.0 (including) 9.1.0 (including)

Potential Mitigations 

References