CVE-2021-36338

Unisphere for PowerMax versions prior to 9.2.2.2 contains a privilege escalation vulnerability. An adjacent malicious user could potentially exploit this vulnerability to escalate their privileges and access functionalities they do not have access to.

CVSS v3.0 8.0 HIGH
CVSS v2.0 5.2 MEDIUM

8.0^/10

CVSS v3.0 : HIGH

Vector :

Exploitability : 2.1 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

5.2^/10

CVSS v2.0 : MEDIUM

Vector : AV:A/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 5.1 / Impact : 6.4

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.dell.com/support/kbdoc/000194640	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:dell:solutions_enabler::::::::
	cpe:2.3:a:dell:solutions_enabler::::::::
	cpe:2.3:a:dell:solutions_enabler_virtual_appliance::::::::
	cpe:2.3:a:dell:solutions_enabler_virtual_appliance::::::::
	cpe:2.3:a:dell:unisphere_360::::::::
	cpe:2.3:a:dell:unisphere_360::::::::
	cpe:2.3:a:dell:unisphere_for_powermax::::::::
	cpe:2.3:a:dell:unisphere_for_powermax::::::::
	cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance::::::::
	cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance::::::::
	cpe:2.3:a:dell:vasa::::::::
	cpe:2.3:a:dell:vasa::::::::
	cpe:2.3:o:dell:powermax_os:5978:::::::*

Information

Published : 2022-01-21 21:15

Updated : 2022-01-28 15:17

NVD link : CVE-2021-36338

Mitre link : CVE-2021-36338

JSON object : View

Products Affected

dell

unisphere_360
unisphere_for_powermax_virtual_appliance
vasa
solutions_enabler
solutions_enabler_virtual_appliance
unisphere_for_powermax
powermax_os

CWE

CWE-669

Incorrect Resource Transfer Between Spheres

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://www.dell.com/support/kbdoc/000194640", "name": "https://www.dell.com/support/kbdoc/000194640", "tags": ["Patch", "Vendor Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Unisphere for PowerMax versions prior to 9.2.2.2 contains a privilege escalation vulnerability. An adjacent malicious user could potentially exploit this vulnerability to escalate their privileges and access functionalities they do not have access to."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-669"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-36338", "ASSIGNER": "secure@dell.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 5.2, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 5.1, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.1}}, "publishedDate": "2022-01-21T21:15Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.1.0.18"}, {"cpe23Uri": "cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.2.3.0", "versionStartIncluding": "9.2.0.0"}, {"cpe23Uri": "cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.1.0.18"}, {"cpe23Uri": "cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.2.3.0", "versionStartIncluding": "9.2.0.0"}, {"cpe23Uri": "cpe:2.3:a:dell:unisphere_360:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.1.0.29"}, {"cpe23Uri": "cpe:2.3:a:dell:unisphere_360:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.2.3.3", "versionStartIncluding": "9.2.0.0"}, {"cpe23Uri": "cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.1.0.31"}, {"cpe23Uri": "cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.2.3.4", "versionStartIncluding": "9.2.0.0"}, {"cpe23Uri": "cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.1.0.31"}, {"cpe23Uri": "cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.2.3.4", "versionStartIncluding": "9.2.0.0"}, {"cpe23Uri": "cpe:2.3:a:dell:vasa:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.1.0.723"}, {"cpe23Uri": "cpe:2.3:a:dell:vasa:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "9.2.3.0", "versionStartIncluding": "9.2.0.0"}, {"cpe23Uri": "cpe:2.3:o:dell:powermax_os:5978:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2022-01-28T15:17Z"}