Cyber Resilience

CVE-2023-32494

Dell Powerscale Onefs 9.2.1.0 – 9.2.1.22

Published
16 August 2023
Modified
20 February 2026
Patch / advisory
View advisory
CVSS Score v3.1 6.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 6th percentile
Risk Priority 45 floored blend · peak EPSS

Summary

CVE-2023-32494 is a medium-severity Improper Handling of Insufficient Privileges (CWE-274) vulnerability in Dell Powerscale Onefs. Its CVSS base score is 6.7 (Medium).

Operationally, ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A10:2025 Mishandling of Exceptional Conditions

EU & UK References

Vulnerability Data

Dell PowerScale OneFS, 8.0.x-9.5.x, contains an improper handling of insufficient privileges vulnerability. A local privileged attacker could potentially exploit this vulnerability, leading to elevation of privilege and affect in compliance mode also.

CWE(s)
CWE-274NVD-CWE-noinfo

Related Threats

CVEs Like This One

CVE-2025-22471Same product: Dell Powerscale Onefs
CVE-2024-22449Same product: Dell Powerscale Onefs
CVE-2024-25953Same product: Dell Powerscale Onefs
CVE-2023-32493Same product: Dell Powerscale Onefs
CVE-2025-30477Same product: Dell Powerscale Onefs
CVE-2023-32492Same product: Dell Powerscale Onefs
CVE-2024-49602Same product: Dell Powerscale Onefs
CVE-2026-24511Same product: Dell Powerscale Onefs
CVE-2023-44295Same product: Dell Powerscale Onefs
CVE-2023-43076Same product: Dell Powerscale Onefs

Affected Assets

dell
powerscale onefs
9.2.1.0 — 9.2.1.22 · 9.4.0.0 — 9.4.0.13 · 9.5.0.0 — 9.5.0.3

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

—

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Enforcing least-privilege access policies directly prevents improper handling of insufficient privileges.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.2 Privileged access rights mostly match
prevents

Privileged-access-rights control directly limits the situations in which insufficient privileges can occur.

A.8.3 Information access restriction mostly match
prevents

Information-access-restriction mechanisms enforce least-privilege checks that mitigate the weakness at runtime.

A.5.15 Access control partial match
prevents

Access control policy defines privilege boundaries but does not guarantee correct runtime handling when privileges prove insufficient.

A.5.18 Access rights partial match
prevents

Access-rights provisioning and review reduce privilege gaps, yet do not address the software’s failure to handle insufficient privileges gracefully.

A.8.18 Use of privileged utility programs partial match
mitigates

Restricting privileged utilities reduces exposure but does not address how the application handles privilege shortfalls.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC practices can include privilege checks, yet the control itself does not mandate handling of insufficient privileges.

Hardening callouts derived

Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).

Oracle Linux 9 (1 rule)
  • V-271452 OL 9 must use a Linux Security Module configured to enforce limits on system services. via CWE-274

References