CVE-2022-33934

Dell PowerScale OneFS, versions 8.2.x through 9.4.x contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges may potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected fields.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.1 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000205618/dsa-2022-271	Vendor Advisory
https://www.dell.com/support/kbdoc/en-us/000205618/dsa-2022-271	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:dell:emc_powerscale_onefs::::::::
	cpe:2.3:o:dell:emc_powerscale_onefs::::::::
	cpe:2.3:o:dell:emc_powerscale_onefs::::::::
	cpe:2.3:o:dell:emc_powerscale_onefs::::::::

History

21 Nov 2024, 07:08

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~4.8~~	v2 : unknown v3 : 7.7
References	~~() https://www.dell.com/support/kbdoc/en-us/000205618/dsa-2022-271 - Vendor Advisory~~	() https://www.dell.com/support/kbdoc/en-us/000205618/dsa-2022-271 - Vendor Advisory

07 Nov 2023, 03:48

Type	Values Removed	Values Added
Summary	Dell PowerScale OneFS, versions 8.2.x through 9.4.x contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges may potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected fields.	Dell PowerScale OneFS, versions 8.2.x through 9.4.x contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges may potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected fields.

Information

Published : 2023-02-10 20:15

Updated : 2024-11-21 07:08

NVD link : CVE-2022-33934

Mitre link : CVE-2022-33934

CVE.ORG link : CVE-2022-33934

JSON object : View

Products Affected

dell

emc_powerscale_onefs

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2022-33934", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.1}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.7}]}, "published": "2023-02-10T20:15:52.777", "references": [{"url": "https://www.dell.com/support/kbdoc/en-us/000205618/dsa-2022-271", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}, {"url": "https://www.dell.com/support/kbdoc/en-us/000205618/dsa-2022-271", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "\nDell PowerScale OneFS, versions 8.2.x through 9.4.x contain multiple stored cross-site scripting vulnerabilities. A remote authenticated malicious user with high privileges may potentially exploit these vulnerabilities to store malicious HTML or JavaScript code through multiple affected fields.\n\n\n\n\n\n"}], "lastModified": "2024-11-21T07:08:38.297", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:emc_powerscale_onefs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F63ABC1C-B320-4D1B-A430-0CA8371E1494", "versionEndIncluding": "9.1.0.23", "versionStartIncluding": "9.1.0.0"}, {"criteria": "cpe:2.3:o:dell:emc_powerscale_onefs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4A3AA726-B6D4-4B39-B7D6-0E0270FB33E5", "versionEndIncluding": "9.2.1.16", "versionStartIncluding": "9.2.1.0"}, {"criteria": "cpe:2.3:o:dell:emc_powerscale_onefs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4FB1971-36EC-4A19-B0DE-C11D6D5E2AA0", "versionEndIncluding": "9.3.0.7", "versionStartIncluding": "9.3.0.0"}, {"criteria": "cpe:2.3:o:dell:emc_powerscale_onefs:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29DA7E87-E4BF-43D8-9DFE-456F7EFE1A67", "versionEndIncluding": "9.4.0.4", "versionStartIncluding": "9.4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security_alert@emc.com"}