CVE-2020-26181: dell emc_isilon_onefs Improper Privilege Management

Vulnerability summary

CVE-2020-26181 is a high (CVSS 7.8) Improper Privilege Management vulnerability in dell emc_isilon_onefs. EPSS estimates a 0.26% chance of exploitation in the next 30 days, higher than 16.3% of scored vulnerabilities.

Timeline

1. 05-01-2021
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Dell EMC Isilon OneFS versions 8.1 and later and Dell EMC PowerScale OneFS version 9.0.0 contain a privilege escalation vulnerability on a SmartLock Compliance mode cluster. The compadmin user connecting using ISI PRIV LOGIN SSH or ISI PRIV LOGIN CONSOLE can elevate privileges to the root user if they have ISI PRIV HARDENING privileges.

• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.