What is CVE-2021-21595?

CVE-2021-21595 is a medium-severity vulnerability in Dell EMC Powerscale Onefs, classified under Command Injection. CVSS score: 6.0/10. Published 2021-08-16.

How severe is CVE-2021-21595?

Medium severity. CVSS v3 base score is 6.0 out of 10.

RCE in Dell EMC Powerscale Onefs

CVE-2021-21595

Dell EMC PowerScale OneFS versions 8.2.x - 9.1.1.x contain an improper neutralization of special elements used in an OS command. This vulnerability could allow the compadmin user to elevate privileges. This only impacts Smartlock WORM compliance mode clusters as a critical vulnerability and Dell recommends to update/upgrade at the earliest opportunity.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.002 (15.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H.

Affected products

Dell Emc_powerscale_onefs — versions 8.2.2
Dell Powerscale Onefs — versions 8.2.x - 9.1.1.x

Weakness classification (CWE)

CWE-77 — Command Injection

References

security_alert@emc.com (Patch, x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-21595?: CVE-2021-21595 is a medium-severity vulnerability in Dell EMC Powerscale Onefs, classified under Command Injection. CVSS score: 6.0/10. Published 2021-08-16.
How severe is CVE-2021-21595?: Medium severity. CVSS v3 base score is 6.0 out of 10.