CVE-2022-31234 - OpenCVE

Dell EMC PowerStore, contain(s) an Improper Restriction of Excessive Authentication Attempts Vulnerability in PowerStore Manager GUI. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to password brute-forcing. Account takeover is possible if weak passwords are used by users.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

Vendors & Products
CPE Configurations

Vendors	Products
Dell	Emc Powerstore 500t Emc Powerstore 3200t Emc Powerstore 1200t Emc Powerstore 500t Firmware Emc Powerstore 3200t Firmware Emc Powerstore 5200t Firmware Emc Powerstore 9200t Firmware Emc Powerstore 5200t Emc Powerstore 1200t Firmware Emc Powerstore 9200t

Configuration 1 [-]

AND

cpe:2.3:o:dell:emc_powerstore_500t_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:emc_powerstore_500t:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:dell:emc_powerstore_1200t_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:emc_powerstore_1200t:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:dell:emc_powerstore_3200t_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:emc_powerstore_3200t:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

cpe:2.3:o:dell:emc_powerstore_5200t_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:emc_powerstore_5200t:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

cpe:2.3:o:dell:emc_powerstore_9200t_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:emc_powerstore_9200t:-:*:*:*:*:*:*:*

References

Link	Resource
https://www.dell.com/support/kbdoc/000201283	Patch Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: dell

Published: 2022-07-07T00:00:00

Updated: 2022-07-20T20:55:18

Reserved: 2022-05-19T00:00:00

Link: CVE-2022-31234

JSON object: View

NVD Information

Status : Analyzed

Published: 2022-07-21T04:15:12.550

Modified: 2022-07-30T01:56:50.157

Link: CVE-2022-31234

JSON object: View

Redhat Information

No data.

CWE

CWE-307

{"containers": {"cna": {"affected": [{"product": "PowerStore", "vendor": "Dell", "versions": [{"lessThan": "v3.0.0.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "datePublic": "2022-07-07T00:00:00", "descriptions": [{"lang": "en", "value": "Dell EMC PowerStore, contain(s) an Improper Restriction of Excessive Authentication Attempts Vulnerability in PowerStore Manager GUI. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to password brute-forcing. Account takeover is possible if weak passwords are used by users."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-307", "description": "CWE-307: Improper Restriction of Excessive Authentication Attempts", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-07-20T20:55:18", "orgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "shortName": "dell"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.dell.com/support/kbdoc/000201283"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@dell.com", "DATE_PUBLIC": "2022-07-07", "ID": "CVE-2022-31234", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "PowerStore", "version": {"version_data": [{"version_affected": "<", "version_value": "v3.0.0.0"}]}}]}, "vendor_name": "Dell"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Dell EMC PowerStore, contain(s) an Improper Restriction of Excessive Authentication Attempts Vulnerability in PowerStore Manager GUI. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to password brute-forcing. Account takeover is possible if weak passwords are used by users."}]}, "impact": {"cvss": {"baseScore": 8.1, "baseSeverity": "High", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-307: Improper Restriction of Excessive Authentication Attempts"}]}]}, "references": {"reference_data": [{"name": "https://www.dell.com/support/kbdoc/000201283", "refsource": "MISC", "url": "https://www.dell.com/support/kbdoc/000201283"}]}}}}, "cveMetadata": {"assignerOrgId": "c550e75a-17ff-4988-97f0-544cde3820fe", "assignerShortName": "dell", "cveId": "CVE-2022-31234", "datePublished": "2022-07-07T00:00:00", "dateReserved": "2022-05-19T00:00:00", "dateUpdated": "2022-07-20T20:55:18", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dell:emc_powerstore_500t_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6E7999B2-9790-43D7-A231-0206A36AEC3C", "versionEndExcluding": "3.0.0.0-1732745", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dell:emc_powerstore_500t:-:*:*:*:*:*:*:*", "matchCriteriaId": "2F396420-8007-401C-985E-436C227B42A9", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dell:emc_powerstore_1200t_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "761D6F6E-D4BF-4B83-8EED-19DF784BB223", "versionEndExcluding": "3.0.0.0-1732745", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dell:emc_powerstore_1200t:-:*:*:*:*:*:*:*", "matchCriteriaId": "FB705779-4464-447D-BFB6-63073FFC026F", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dell:emc_powerstore_3200t_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "191F6EDA-88C2-4C18-89B5-0D6200FD15CE", "versionEndExcluding": "3.0.0.0-1732745", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dell:emc_powerstore_3200t:-:*:*:*:*:*:*:*", "matchCriteriaId": "C19A09B3-64C4-4FBF-91DA-782E117FD0F2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dell:emc_powerstore_5200t_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "428A51ED-C8B5-4FC0-84E2-D74D2B3F7447", "versionEndExcluding": "3.0.0.0-1732745", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dell:emc_powerstore_5200t:-:*:*:*:*:*:*:*", "matchCriteriaId": "E67E33BD-8D23-4B30-83A6-B2105ACF5EFC", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:dell:emc_powerstore_9200t_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "5BD1DB6E-CB42-4A67-98D6-23F0E88BDEE5", "versionEndExcluding": "3.0.0.0-1732745", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:dell:emc_powerstore_9200t:-:*:*:*:*:*:*:*", "matchCriteriaId": "20FD2CBE-D0CE-442C-B961-E8DE951A4645", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "Dell EMC PowerStore, contain(s) an Improper Restriction of Excessive Authentication Attempts Vulnerability in PowerStore Manager GUI. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to password brute-forcing. Account takeover is possible if weak passwords are used by users."}, {"lang": "es", "value": "Dell EMC PowerStore, contiene una vulnerabilidad de restricci\u00f3n inapropiada de intentos de autenticaci\u00f3n excesivos en la GUI de PowerStore Manager. Un atacante remoto no autenticado podr\u00eda explotar esta vulnerabilidad, conllevando a forzar la contrase\u00f1a. La toma de control de la cuenta es posible si los usuarios usan contrase\u00f1as d\u00e9biles"}], "id": "CVE-2022-31234", "lastModified": "2022-07-30T01:56:50.157", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security_alert@emc.com", "type": "Secondary"}]}, "published": "2022-07-21T04:15:12.550", "references": [{"source": "security_alert@emc.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://www.dell.com/support/kbdoc/000201283"}], "sourceIdentifier": "security_alert@emc.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-307"}], "source": "security_alert@emc.com", "type": "Secondary"}]}