CVE-2022-31228 - OpenCVE

Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability and gain access to an admin account.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Dell	Xtremio X1 Xtremio Management Server Xtremio X2

Configuration 1 [-]

AND

cpe:2.3:a:dell:xtremio_management_server:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:dell:xtremio_x1:-:::::::*
	cpe:2.3:h:dell:xtremio_x2:-:::::::*

References

Link	Resource
https://www.dell.com/support/kbdoc/en-us/000204112/dsa-2022-145-dell-emc-xtremeio-for-ssh-and-web-ui-vulnerability	Patch Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: dell

Published: 2022-10-11T00:00:00

Updated: 2022-10-12T00:00:00

Reserved: 2022-05-19T00:00:00

Link: CVE-2022-31228

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-10-12T20:15:10.013

Modified: 2022-10-14T20:13:00.390

Link: CVE-2022-31228

JSON object: View

Redhat Information

No data.

CWE

CWE-307

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:dell:xtremio_management_server:*:*:*:*:*:*:*:*", "matchCriteriaId": "4832EC4C-D85E-4DC3-AF45-1CFF85F49D26", "versionEndExcluding": "6.4.0-22", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dell:xtremio_x1:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2C95E96-3549-41CE-84B0-9EDEA1EE9D8D", "vulnerable": false}, {"criteria": "cpe:2.3:h:dell:xtremio_x2:-:*:*:*:*:*:*:*", "matchCriteriaId": "31A977D9-77DA-4FF3-9963-1F93B09961D1", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Dell EMC XtremIO versions prior to X2 6.4.0-22 contain a bruteforce vulnerability. A remote unauthenticated attacker can potentially exploit this vulnerability and gain access to an admin account."}, {"lang": "es", "value": "Dell EMC XtremIO versiones anteriores a X2 6.4.0-22, contienen una vulnerabilidad de fuerza bruta. Un atacante remoto no autenticado puede explotar potencialmente esta vulnerabilidad y conseguir acceso a una cuenta de administrador"}], "id": "CVE-2022-31228", "lastModified": "2022-10-14T20:13:00.390", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security_alert@emc.com", "type": "Secondary"}]}, "published": "2022-10-12T20:15:10.013", "references": [{"source": "security_alert@emc.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/en-us/000204112/dsa-2022-145-dell-emc-xtremeio-for-ssh-and-web-ui-vulnerability"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-307"}], "source": "security_alert@emc.com", "type": "Secondary"}]}