PT-2017-18059 · Emc · Scaleio

David Berard · Publicado 2017-11-28 · Atualizado 2019-11-14 · CVE-2017-8001

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EMC ScaleIO version 2.0.1.x

Description An issue was discovered where a support script in a Linux environment saves the credentials of the ScaleIO MDM user in clear text in temporary log files. These temporary files may be read by an unprivileged user with access to the server to recover exposed credentials.

Recommendations For EMC ScaleIO version 2.0.1.x, consider restricting access to the temporary log files generated by the support script to prevent unauthorized users from reading the exposed credentials. As a temporary workaround, restrict access to the server where the script was executed to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2017-8001

Produtos afetados

Scaleio

Referências · 4

• http://seclists.org/fulldisclosure/2017/Nov/35 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-8001 · Nota de Segurança
• http://securityfocus.com/bid/101997 · Nota
• https://osv.dev/vulnerability/CVE-2017-8001 · Aviso do Fabricante