Sign-up

ID

VAR-202206-0057


CVE

CVE-2022-22557


TITLE

Dell's  powerstoreos  Vulnerability regarding insufficient protection of authentication information in

Trust: 0.8

sources: JVNDB: JVNDB-2022-010919

DESCRIPTION

PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x and 2.0.1.x A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account. Dell's powerstoreos There are vulnerabilities in inadequate protection of credentials.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Dell PowerStore all-flash data storage appliances use a data-centric, highly adaptable intelligent infrastructure to deliver AppsON capabilities to transform traditional and modern workloads. An authorization issue vulnerability exists in Dell PowerStore, which can be exploited by attackers to leak certain user credentials

Trust: 2.25

sources: NVD: CVE-2022-22557 // JVNDB: JVNDB-2022-010919 // CNVD: CNVD-2022-83208 // VULMON: CVE-2022-22557

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-83208

AFFECTED PRODUCTS

vendor:dellmodel:powerstoreosscope:ltversion:2.1.1.0

Trust: 1.0

vendor:dellmodel:powerstoreosscope:gteversion:2.0.0.0

Trust: 1.0

vendor:dellmodel:powerstoreosscope:ltversion:2.1.0.0

Trust: 1.0

vendor:デルmodel:powerstoreosscope:eqversion: -

Trust: 0.8

vendor:デルmodel:powerstoreosscope:eqversion:2.0.0.0 that's all 2.1.0.0

Trust: 0.8

vendor:デルmodel:powerstoreosscope:eqversion:2.0.0.0 that's all 2.1.1.0

Trust: 0.8

vendor:デルmodel:powerstoreosscope: - version: -

Trust: 0.8

vendor:dellmodel:powerstorescope:eqversion:2.0.0.*

Trust: 0.6

vendor:dellmodel:powerstorescope:eqversion:2.0.1.*

Trust: 0.6

sources: CNVD: CNVD-2022-83208 // JVNDB: JVNDB-2022-010919 // NVD: CVE-2022-22557

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2022-22557
value: HIGH

Trust: 1.0

security_alert@emc.com: CVE-2022-22557
value: HIGH

Trust: 1.0

NVD: CVE-2022-22557
value: HIGH

Trust: 0.8

CNVD: CNVD-2022-83208
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202206-416
value: HIGH

Trust: 0.6

VULMON: CVE-2022-22557
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2022-22557
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2022-83208
severity: HIGH
baseScore: 7.2
vectorString: AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2022-22557
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

security_alert@emc.com: CVE-2022-22557
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 0.8
impactScore: 6.0
version: 3.1

Trust: 1.0

NVD: CVE-2022-22557
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2022-83208 // VULMON: CVE-2022-22557 // JVNDB: JVNDB-2022-010919 // CNNVD: CNNVD-202206-416 // NVD: CVE-2022-22557 // NVD: CVE-2022-22557

PROBLEMTYPE DATA

problemtype:CWE-522

Trust: 1.0

problemtype:CWE-256

Trust: 1.0

problemtype:Inadequate protection of credentials (CWE-522) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-010919 // NVD: CVE-2022-22557

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202206-416

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-202206-416

PATCH

title:Patch for Dell PowerStore Authorization Issue Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/362271

Trust: 0.6

title:Dell EMC PowerStore Remediation measures for authorization problem vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=195970

Trust: 0.6

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-23305

Trust: 0.1

title:CVE-2022-XXXXurl:https://github.com/AlphabugX/CVE-2022-RCE

Trust: 0.1

sources: CNVD: CNVD-2022-83208 // VULMON: CVE-2022-22557 // CNNVD: CNNVD-202206-416

EXTERNAL IDS

db:NVDid:CVE-2022-22557

Trust: 3.9

db:JVNDBid:JVNDB-2022-010919

Trust: 0.8

db:CNVDid:CNVD-2022-83208

Trust: 0.6

db:CNNVDid:CNNVD-202206-416

Trust: 0.6

db:VULMONid:CVE-2022-22557

Trust: 0.1

sources: CNVD: CNVD-2022-83208 // VULMON: CVE-2022-22557 // JVNDB: JVNDB-2022-010919 // CNNVD: CNNVD-202206-416 // NVD: CVE-2022-22557

REFERENCES

url:https://www.dell.com/support/kbdoc/000196367

Trust: 3.1

url:https://nvd.nist.gov/vuln/detail/cve-2022-22557

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-22557/

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/522.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://github.com/alphabugx/cve-2022-23305

Trust: 0.1

sources: CNVD: CNVD-2022-83208 // VULMON: CVE-2022-22557 // JVNDB: JVNDB-2022-010919 // CNNVD: CNNVD-202206-416 // NVD: CVE-2022-22557

SOURCES

db:CNVDid:CNVD-2022-83208
db:VULMONid:CVE-2022-22557
db:JVNDBid:JVNDB-2022-010919
db:CNNVDid:CNNVD-202206-416
db:NVDid:CVE-2022-22557

LAST UPDATE DATE

2024-11-23T22:28:58.197000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-83208date:2022-11-30T00:00:00
db:VULMONid:CVE-2022-22557date:2023-07-24T00:00:00
db:JVNDBid:JVNDB-2022-010919date:2023-08-17T08:35:00
db:CNNVDid:CNNVD-202206-416date:2023-07-25T00:00:00
db:NVDid:CVE-2022-22557date:2024-11-21T06:47:01.300

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-83208date:2022-11-30T00:00:00
db:VULMONid:CVE-2022-22557date:2022-06-02T00:00:00
db:JVNDBid:JVNDB-2022-010919date:2023-08-17T00:00:00
db:CNNVDid:CNNVD-202206-416date:2022-06-02T00:00:00
db:NVDid:CVE-2022-22557date:2022-06-02T21:15:07.557