CVE-2022-45099

Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. A malicious and privileged local attacker could potentially exploit this vulnerability, leading to a full system compromise

Weakness

Obscuring a password with a trivial encoding does not protect the password.

Affected Software

Name	Vendor	Start Version	End Version
Emc_powerscale_onefs	Dell	9.1.0.0 (including)	9.1.0.24 (excluding)
Emc_powerscale_onefs	Dell	9.2.1.0 (including)	9.2.1.18 (excluding)
Emc_powerscale_onefs	Dell	9.3.0.0 (including)	9.3.0.7 (excluding)
Emc_powerscale_onefs	Dell	9.4.0.0 (including)	9.4.0.9 (excluding)

Potential Mitigations

https://cwe.mitre.org/data/definitions/55.html

References

https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities
https://www.dell.com/support/kbdoc/en-us/000206357/dell-emc-powerscale-onefs-security-updates-for-multiple-security-vulnerabilities

NVD	https://nvd.nist.gov/vuln/detail/CVE-2022-45099
CWE	https://cwe.mitre.org/data/definitions/261.html

Weak Encoding for Password

Weakness

Affected Software

Potential Mitigations

Related Attack Patterns

References