Path traversal in Dell PowerScale OneFS
Priority LOW 24CWE-23Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-23 and the CVSS impact.
Summary
Dell PowerScale OneFS, versions 9.0.0 up to and including 9.1.0.20, 9.2.1.13, 9.3.0.6, and 9.4.0.3, contain a relative path traversal vulnerability. A low privileged local attacker could potentially exploit this vulnerability, leading to denial of service.
Why it matters now
EPSS 0.00201 10th percentileScored 2026-11-07
Fix Fixed PowerScale OneFS (Dell): 8.2.x, 9.0.0.x, 9.1.0.x +5
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Dell | PowerScale OneFS | before 8.2.x, 9.0.0.x, 9.1.0.x, 9.1.1.x, 9.2.0.x, 9.2.1.x, 9.3.0.x. 9.4.0.x, 9.5.0.x | 8.2.x, 9.0.0.x, 9.1.0.x, 9.1.1.x, 9.2.0.x, 9.2.1.x, 9.3.0.x. 9.4.0.x, 9.5.0.x | Patch available | CNA |
- PowerScale OneFS VendorDell Affected before 8.2.x, 9.0.0.x, 9.1.0.x, 9.1.1.x, 9.2.0.x, 9.2.1.x, 9.3.0.x. 9.4.0.x, 9.5.0.x Fixed in 8.2.x, 9.0.0.x, 9.1.0.x, 9.1.1.x, 9.2.0.x, 9.2.1.x, 9.3.0.x. 9.4.0.x, 9.5.0.x Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:dell:emc_powerscale_onefs:*:*:*:*:*:*:*:* | 9.1.0.0 – 9.1.0.20; 9.2.1.0 – 9.2.1.13; 9.3.0.0 – 9.3.0.6; 9.4.0.0 – 9.4.0.3 | Vulnerable | Dell |
- cpe:2.3:o:dell:emc_powerscale_onefs:*:*:*:*:*:*:*:* Versions 9.1.0.0 – 9.1.0.20; 9.2.1.0 – 9.2.1.13; 9.3.0.0 – 9.3.0.6; 9.4.0.0 – 9.4.0.3 Vulnerable ·Dell
Remediation
- Fix · CNA PowerScale OneFS (Dell) Fixed in 8.2.x, 9.0.0.x, 9.1.0.x, 9.1.1.x, 9.2.0.x, 9.2.1.x, 9.3.0.x. 9.4.0.x, 9.5.0.x
Timeline
- 2026-10-02 Threatist record created from CVE-2022-34378
- 2026-10-03 Alias added: GHSA-8mm7-v538-f52q
References
More Dell Emc Powerscale Onefs vulnerabilities
- TI-2022-22190 Improper privilege management in Dell PowerScale OneFS CVSS 3.1CRITICAL 9.8
- TI-2022-10097 Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random… CVSS 3.1CRITICAL 9.8
- TI-2022-06835 Missing brute-force protection in Dell PowerScale OneFS CVSS 3.1CRITICAL 9.8
- TI-2021-04595 Improper authentication in Dell PowerScale OneFS CVSS 3.1CRITICAL 9.8
- TI-2022-22189 Improper certificate validation in Dell PowerScale OneFS CVSS 3.1CRITICAL 9.8
- TI-2022-15270 Insufficiently protected credentials in Dell PowerScale OneFS CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-34378 · CVE Program
- CVE-2022-34378 · NVD
- FIRST EPSS
- GHSA-8mm7-v538-f52q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences