by Kastro
Paper/Archive/CVE-2021-21502

CVE-2021-21502

Dell PowerScale OneFS — Dell PowerScale OneFS versions 8.1.0 – 9.1.0 contain a "use of SSH key past account expiration" vulnerability.

EPSS 1%CVSS 9.8
critical.is priorityof 100
44
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 72.7.727 × 2014.5No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Dell PowerScale OneFS versions 8.1.0 – 9.1.0 contain a "use of SSH key past account expiration" vulnerability. A user on the network with the ISI_PRIV_AUTH_SSH RBAC privilege that has an expired account may potentially exploit this vulnerability, giving them access to the same things they had before account expiration. This may by a high privileged account and hence Dell recommends customers upgrade at the earliest opportunity.

Affected

ProductAffectedFixed inSource
PowerScale OneFSunspecified – < 8.1.2 / 8.2.2 / 9.1.0.x / Empire / Main8.1.2 / 8.2.2 / 9.1.0.x / Empire / MainCNA

Scores by source

dell (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refdell.com/support/kbdoc/en-us/000182873/dsa-2021-009-dell-powerscale-onefs-security-update-for-multiple-vulnerabilities