Dell PowerScale OneFS SQL Injection Vulnerability Leading to Denial-of-Service and Information Issues

A SQL injection vulnerability has been identified in Dell PowerScale OneFS versions 9.5.0.0 through 9.10.0.1. This vulnerability arises from improper neutralization of special elements used in SQL commands, allowing a low-privileged attacker with local access to potentially exploit the issue. The exploitation could result in denial-of-service, information disclosure, and information tampering.

Impact

Exploitation of this vulnerability could lead to a denial-of-service, unauthorized information disclosure, and unauthorized modification of information.

Remediation

Users are advised to upgrade to version 9.10.1.2 or later. For versions 9.7.0.0 through 9.7.1.7, upgrade to version 9.7.1.8 or later. For versions 9.5.0.0 through 9.5.1.2, upgrade to version 9.5.1.3 or later. The PowerScale OneFS Downloads Area can be accessed for the latest versions.