Medium severity · published Feb 13, 2023
CVE-2022-34397
Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 10.0.0.5 and below contains an authorization bypass vulnerability, allowing users to…
5.7
CVSS
0.2%
EPSS
No
On KEV
Description
Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 10.0.0.5 and below contains an authorization bypass vulnerability, allowing users to perform actions in which they are not authorized.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EP
Evasa Provider Virtual Appliance · Dell
before 9.2.4.15 · source: NVD
SE
Solutions Enabler Virtual Appliance · Dell
before 9.2.3.6; before 9.2.4.26 · source: NVD
UF
Unisphere For Powermax Virtual Appliance · Dell
before 9.2.3.22; before 9.2.4.26 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-34397
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-34397
Patch
https://www.dell.com/support/kbdoc/en-us/000207177/dsa-2022-340-dell-unisphere-for-powermax-dell-unisphere-for-powermax-vapp-dell-solutions-enabler-vapp-dell-unisphere-360-dell-vasa-provider-vapp-and-dell-powermax-emb-mgmt-security-update-for-multiple-vulnerabilities
More from Evasa Provider Virtual Appliance
8.8
CVE-2022-45104
Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain a command execution vulnerability
8.0
CVE-2022-31233
Unisphere for PowerMax versions before 9.2.3.15 contain a privilege escalation vulnerability