CVE-2021-21502: dell emc_powerscale_onefs Improper Authentication

Vulnerability summary

CVE-2021-21502 is a critical (CVSS 9.8) Improper Authentication vulnerability in dell emc_powerscale_onefs. EPSS estimates a 1.41% chance of exploitation in the next 30 days, higher than 72.3% of scored vulnerabilities.

Timeline

1. 09-02-2021
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

Dell PowerScale OneFS versions 8.1.0 – 9.1.0 contain a "use of SSH key past account expiration" vulnerability. A user on the network with the ISI_PRIV_AUTH_SSH RBAC privilege that has an expired account may potentially exploit this vulnerability, giving them access to the same things they had before account expiration. This may by a high privileged account and hence Dell recommends customers upgrade at the earliest opportunity.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.