文書番号: 000186363

DSA-2021-091: Dell EMC XtremIO Security Update for Multiple Vulnerabilities

概要: Dell EMC XtremIO remediation is available for multiple security vulnerabilities that could be exploited by malicious users to compromise the affected system.

文書の内容

影響

High

詳細

Proprietary Code CVE(s)	Description	CVSSBase Score	CVSS Vector String
CVE-2021-21549	Dell EMC XtremIO Versions prior to 6.3.3-8, contain a Cross-Site Request Forgery Vulnerability in XMS. A non-privileged attacker could potentially exploit this vulnerability, leading to a privileged victim application user being tricked into sending state-changing requests to the vulnerable application, causing unintended server operations.	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Third-Party Component

CVE(s)

More information

OpenSSL

CVE-2020-1971

See NVD (http://nvd.nist.gov/) for individual scores for each CVE

Proprietary Code CVE(s)	Description	CVSSBase Score	CVSS Vector String
CVE-2021-21549	Dell EMC XtremIO Versions prior to 6.3.3-8, contain a Cross-Site Request Forgery Vulnerability in XMS. A non-privileged attacker could potentially exploit this vulnerability, leading to a privileged victim application user being tricked into sending state-changing requests to the vulnerable application, causing unintended server operations.	8.8	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Third-Party Component

CVE(s)

More information

OpenSSL

CVE-2020-1971

See NVD (http://nvd.nist.gov/) for individual scores for each CVE

デル・テクノロジーズでは、すべてのお客様に対して、CVSSベーススコアに加えて、特定のセキュリティの脆弱性に付随する潜在的な重要度に影響する可能性のある現状スコアや環境スコアも考慮することをお勧めしています。

影響を受ける製品と修復

CVE(s) Addressed	Product	Affected Version(s)	Updated Version(s)	Link to Update
CVE-2020-1971	XtremIO X1, XtremIO X2	XMS versions prior to 6.3.3-8	XMS 6.3.3-8	Dell EMC recommends all customers upgrade at the earliest opportunity. Customers can contact Dell EMC support to perform the upgrade.
CVE-2021-21549

CVE(s) Addressed	Product	Affected Version(s)	Updated Version(s)	Link to Update
CVE-2020-1971	XtremIO X1, XtremIO X2	XMS versions prior to 6.3.3-8	XMS 6.3.3-8	Dell EMC recommends all customers upgrade at the earliest opportunity. Customers can contact Dell EMC support to perform the upgrade.
CVE-2021-21549

回避策と緩和策

None

確認

CVE-2021-21549: Dell would like to thank Tomasz Stachowicz for reporting this issue.

変更履歴

Revision	Date	Description
1.0	2021-05-13	Initial Release

法的情報

文書のプロパティ

影響を受ける製品

XtremIO, Product Security Information, XtremIO Family, XtremIO HW Gen2 400GB, XtremIO HW Gen2 400GB Encrypt Capbl, XtremIO HW Gen2 400GB Encrypt Disable, XtremIO HW Gen2 400GB Exp Encrypt Disable, XtremIO HW Gen2 400GB Expandable , XtremIO HW Gen2 800GB Encrypt Capbl ...

製品

XtremIO HW Gen2 800GB Encrypt Disable, XtremIO HW Gen3 40TB, XtremIO HW Gen3 40TB Encrypt Disable, XtremIO HW X2-R, XtremIO HW X2-R Encrypt Disable, XtremIO HW X2-S, XtremIO HW X2-S Encrypt Disable, XtremIO HW X2-T, XtremIO HW X2-T Encrypt Disable , XtremIO X1, XtremIO X2 ...

最後に公開された日付

13 5月 2021

文書の種類

Dell Security Advisory

トップに戻る

ようこそ

Dellへようこそ