CVE-2022-22557

PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x and 2.0.1.x A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.

CVSS v3 7.5 HIGH
CVSS v2.0 7.2 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 0.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://www.dell.com/support/kbdoc/000196367	Vendor Advisory
https://www.dell.com/support/kbdoc/000196367	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:dell:powerstoreos:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:powerstore_t:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:dell:powerstoreos:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:powerstore_x:-:*:*:*:*:*:*:*

History

21 Nov 2024, 06:47

Type	Values Removed	Values Added
CVSS	v2 : ~~7.2~~ v3 : ~~7.8~~	v2 : 7.2 v3 : 7.5
References	~~() https://www.dell.com/support/kbdoc/000196367 - Vendor Advisory~~	() https://www.dell.com/support/kbdoc/000196367 - Vendor Advisory

24 Jul 2023, 13:31

Type	Values Removed	Values Added
CWE	~~CWE-287~~	CWE-522

Information

Published : 2022-06-02 21:15

Updated : 2024-11-21 06:47

NVD link : CVE-2022-22557

Mitre link : CVE-2022-22557

CVE.ORG link : CVE-2022-22557

JSON object : View

Products Affected

dell

powerstore_x
powerstore_t
powerstoreos

CWE

CWE-256

Plaintext Storage of a Password

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2022-22557", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2022-06-02T21:15:07.557", "references": [{"url": "https://www.dell.com/support/kbdoc/000196367", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}, {"url": "https://www.dell.com/support/kbdoc/000196367", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-256"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "PowerStore contains Plain-Text Password Storage Vulnerability in PowerStore X & T environments running versions 2.0.0.x and 2.0.1.x A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account."}, {"lang": "es", "value": "PowerStore contiene una vulnerabilidad de almacenamiento de contrase\u00f1as en texto plano en entornos PowerStore X & T ejecutando las versiones 2.0.0.x y 2.0.1.x Un atacante autenticado localmente podr\u00eda explotar esta vulnerabilidad, conllevando a una divulgaci\u00f3n de determinadas credenciales de usuario. El atacante podr\u00eda usar las credenciales expuestas para acceder a la aplicaci\u00f3n vulnerable con los privilegios de la cuenta comprometida"}], "lastModified": "2024-11-21T06:47:01.300", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:powerstoreos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F2C43D89-8789-4516-95D3-F1616BDE803B", "versionEndExcluding": "2.1.0.0", "versionStartIncluding": "2.0.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:powerstore_t:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "68266E9E-493B-4481-937A-70CD0A7C353D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:powerstoreos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84872DDA-0E67-4DB0-AB9E-5FFB2392EC5F", "versionEndExcluding": "2.1.1.0", "versionStartIncluding": "2.0.0.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:powerstore_x:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0CB6F8F1-8856-47B8-93BD-2D3F5164ED9D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security_alert@emc.com"}