Incorrect Resource Transfer Between Spheres in Unisphere for PowerMax - CVE-2021-36338

Vulnerability identifier: #VU69363

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-36338

CWE-ID: CWE-669

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker on a local network to gain elevated privileges.

The vulnerability exists due to incorrect resource transfer between spheres. A remote attacker on a local network can escalate their privileges and access functionalities they do not have access to.

Unisphere for PowerMax
Solutions Enabler
Unisphere 360
Unisphere for PowerMax Virtual Appliance
VASA Provider Standalone
Solutions Enabler Virtual Appliance

Install update from vendor's website.

Unisphere for PowerMax - addressed in versions 9.2.2.2, 9.1.0.31, 9.2.3.4
Solutions Enabler Virtual Appliance - addressed in versions 9.1.0.18, 9.2.3.0
Solutions Enabler - addressed in versions 9.1.0.18, 9.2.3.0
Unisphere 360 - addressed in versions 9.1.0.29, 9.2.3.3
Unisphere for PowerMax Virtual Appliance - addressed in versions 9.1.0.31, 9.2.3.4
VASA Provider Standalone - addressed in versions 9.1.0.723, 9.2.3.0

• https://www.dell.com/support/kbdoc/000194640

• Multiple vulnerabilities in Dell Unisphere for PowerMax, Dell Solutions Enabler, Dell Unisphere 360, Dell VASA