IBM Storage Scale (command input neutralization): An authenticated user can execute privileged commands due to improper

Impact

An authenticated user can execute privileged commands due to improper input neutralization. On a shared storage cluster the set of 'authenticated users' is much wider than the set of storage admins — it typically includes every tenant service account with a filesystem role.

Who can reach it

Authenticated user on Storage Scale 5.2.2.0 or 5.2.2.1 under certain configurations.

What to do

Upgrade Storage Scale past 5.2.2.1 — rolling node upgrade. Review which accounts hold command-line access to the storage cluster in the meantime; most fleets have accumulated more than they intended.

References