CVE-2021-21531 - Vulnerability Details - OpenCVE

Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. A local authenticated malicious user with monitor role may exploit this vulnerability to perform unauthorized actions.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Dell	Powermax Os Solutions Enabler Solutions Enabler Virtual Appliance Unisphere For Powermax Unisphere For Powermax Virtual Appliance

Configuration 1 [-]

OR	cpe:2.3:a:dell:solutions_enabler::::::::
	cpe:2.3:a:dell:solutions_enabler::::::::
	cpe:2.3:a:dell:solutions_enabler_virtual_appliance::::::::
	cpe:2.3:a:dell:solutions_enabler_virtual_appliance::::::::
	cpe:2.3:a:dell:unisphere_for_powermax::::::::
	cpe:2.3:a:dell:unisphere_for_powermax::::::::
	cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance::::::::
	cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance::::::::
	cpe:2.3:o:dell:powermax_os:5978:::::::*

No data.

References

Link	Providers
https://www.spirityenterprise.com/virtual-ciso
https://www.dell.com/support/kbdoc/000184565

History

No history.

MITRE

Status: PUBLISHED

Assigner: dell

Published: 2021-04-30T21:10:18.600Z

Updated: 2024-09-17T03:48:26.799Z

Reserved: 2021-01-04T00:00:00.000Z

Link: CVE-2021-21531

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-04-30T21:15:08.673

Modified: 2024-11-21T05:48:32.150

Link: CVE-2021-21531

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Unisphere for PowerMax", "vendor": "Dell", "versions": [{"lessThan": "9.2.1.6", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2021-03-24T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. A local authenticated malicious user with monitor role may exploit this vulnerability to perform unauthorized actions."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-602", "description": "CWE-602: Client-Side Enforcement of Server-Side Security", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-04-30T21:10:18.000Z", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.dell.com/support/kbdoc/000184565"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@dell.com", "DATE_PUBLIC": "2021-03-24", "ID": "CVE-2021-21531", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Unisphere for PowerMax", "version": {"version_data": [{"version_affected": "<", "version_value": "9.2.1.6"}]}}]}, "vendor_name": "Dell"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. A local authenticated malicious user with monitor role may exploit this vulnerability to perform unauthorized actions."}]}, "impact": {"cvss": {"baseScore": 8.1, "baseSeverity": "High", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-602: Client-Side Enforcement of Server-Side Security"}]}]}, "references": {"reference_data": [{"name": "https://www.dell.com/support/kbdoc/000184565", "refsource": "MISC", "url": "https://www.dell.com/support/kbdoc/000184565"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T18:16:22.985Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.dell.com/support/kbdoc/000184565"}]}]}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2021-21531", "datePublished": "2021-04-30T21:10:18.600Z", "dateReserved": "2021-01-04T00:00:00.000Z", "dateUpdated": "2024-09-17T03:48:26.799Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*", "matchCriteriaId": "BC3DAEF1-0C50-4683-ADD8-DFF2A82CA9B3", "versionEndExcluding": "9.1.0.15", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:solutions_enabler:*:*:*:*:*:*:*:*", "matchCriteriaId": "D1A1B910-6302-4097-8AEB-CD3DA665A5B2", "versionEndExcluding": "9.2.1.6", "versionStartIncluding": "9.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*", "matchCriteriaId": "1A6E2D9A-1E3A-4671-8D11-7A0C51C3CFBB", "versionEndExcluding": "9.1.0.15", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:solutions_enabler_virtual_appliance:*:*:*:*:*:*:*:*", "matchCriteriaId": "F854B320-C194-4FA9-B972-EFFE909E9005", "versionEndExcluding": "9.2.1.1", "versionStartIncluding": "9.2.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*", "matchCriteriaId": "EAFA10BE-64D3-40D9-BA46-867A8345E90B", "versionEndExcluding": "9.1.0.26", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:unisphere_for_powermax:*:*:*:*:*:*:*:*", "matchCriteriaId": "A57086A5-CF0C-4DCC-86D5-3159133CFF74", "versionEndIncluding": "9.2.1.6", "versionStartIncluding": "9.2.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*", "matchCriteriaId": "716AFCCC-1F9E-4C34-A02C-5924EF32BA23", "versionEndExcluding": "9.1.0.26", "vulnerable": true}, {"criteria": "cpe:2.3:a:dell:unisphere_for_powermax_virtual_appliance:*:*:*:*:*:*:*:*", "matchCriteriaId": "040B6E33-2F65-474F-9412-C9A4BBFD15FE", "versionEndExcluding": "9.2.1.6", "versionStartIncluding": "9.2.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:dell:powermax_os:5978:*:*:*:*:*:*:*", "matchCriteriaId": "43696C46-48E8-43E4-9387-77CE1B2BD401", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Dell Unisphere for PowerMax versions prior to 9.2.1.6 contain an Authorization Bypass Vulnerability. A local authenticated malicious user with monitor role may exploit this vulnerability to perform unauthorized actions."}, {"lang": "es", "value": "Dell Unisphere para PowerMax versiones anteriores a 9.2.1.6, contienen una vulnerabilidad de Omisi\u00f3n de Autorizaci\u00f3n. Un usuario malicioso local autenticado con role de monitor puede explotar esta vulnerabilidad para llevar a cabo acciones no autorizadas."}], "id": "CVE-2021-21531", "lastModified": "2024-11-21T05:48:32.150", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "security_alert@emc.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-04-30T21:15:08.673", "references": [{"source": "security_alert@emc.com", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/000184565"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/000184565"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-602"}], "source": "security_alert@emc.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-669"}], "source": "nvd@nist.gov", "type": "Primary"}]}