CVE-2020-26191

EUVD-2020-18816 · Published Feb 9, 2021

Dell EMC PowerScale OneFS versions 8.1.0 - 9.1.0 contain a privilege escalation vulnerability. A user with ISI_PRIV_JOB_ENGINE may use the PermissionRepair job to grant themselves the highest level of RBAC privileges thus being able to read arbitrary data, tamper with system software or deny service to users.

Technologies

Dell Emc Powerscale Onefs

Weaknesses

CWE-269

CVSS scores

v3.17.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
v2.04.6AV:L/AC:L/Au:N/C:P/I:P/A:P

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Privilege Escalation

T1068Exploitation for Privilege Escalation T1548Abuse Elevation Control Mechanism

References

https://www.dell.com/support/kbdoc/en-us/000182873/dsa-2021-009-dell-powerscale-onefs-security-update-for-multiple-vulnerabilities

Potentially impacted assets

See if this affects your attack surface