CVE-2022-32498

Dell EMC PowerStore, Versions prior to v3.0.0.0 contain a DLL Hijacking vulnerability in PSTCLI. A local attacker can potentially exploit this vulnerability to execute arbitrary code, escalate privileges, and bypass software allow list solutions, leading to system takeover or IP exposure.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 4.7

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/000201283	Patch Vendor Advisory
https://www.dell.com/support/kbdoc/000201283	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:dell:powerstore_command_line_interface:*:*:*:*:*:linux:*:*

History

21 Nov 2024, 07:06

Type	Values Removed	Values Added
References	~~() https://www.dell.com/support/kbdoc/000201283 - Patch, Vendor Advisory~~	() https://www.dell.com/support/kbdoc/000201283 - Patch, Vendor Advisory
CVSS	v2 : ~~unknown~~ v3 : ~~7.8~~	v2 : unknown v3 : 5.5

Information

Published : 2022-07-21 04:15

Updated : 2024-11-21 07:06

NVD link : CVE-2022-32498

Mitre link : CVE-2022-32498

CVE.ORG link : CVE-2022-32498

JSON object : View

Products Affected

dell

powerstore_command_line_interface

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2022-32498", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.7, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2022-07-21T04:15:12.767", "references": [{"url": "https://www.dell.com/support/kbdoc/000201283", "tags": ["Patch", "Vendor Advisory"], "source": "security_alert@emc.com"}, {"url": "https://www.dell.com/support/kbdoc/000201283", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-427"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "Dell EMC PowerStore, Versions prior to v3.0.0.0 contain a DLL Hijacking vulnerability in PSTCLI. A local attacker can potentially exploit this vulnerability to execute arbitrary code, escalate privileges, and bypass software allow list solutions, leading to system takeover or IP exposure."}, {"lang": "es", "value": "Dell EMC PowerStore, versiones anteriores a v3.0.0.0, contienen una vulnerabilidad de secuestro de DLL en PSTCLI. Un atacante local puede explotar potencialmente esta vulnerabilidad para ejecutar c\u00f3digo arbitrario, escalar privilegios y omitir las soluciones de la lista de permisos del software, conllevando la toma de control del sistema o la exposici\u00f3n de la IP"}], "lastModified": "2024-11-21T07:06:29.463", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:dell:powerstore_command_line_interface:*:*:*:*:*:linux:*:*", "vulnerable": true, "matchCriteriaId": "7FE54BC7-CBF6-4D77-AED4-E9BF5733A70F", "versionEndExcluding": "3.0.0.0-1732745"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}