PT-2019-16684 · Dell Emc · Unityvsa+2

Publicado 2019-07-18 · Atualizado 2020-02-10 · CVE-2019-3741

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116

Description The issue concerns the storage of passwords in plain text within the Unity Data Collection bundle, which includes log files for troubleshooting purposes. Specifically, a Unisphere user's password, including those with admin privileges, is stored in plain text. This could allow a local authenticated attacker with access to the Data Collection bundle to use the exposed password and gain access with the privileges of the compromised user.

Recommendations For versions prior to 5.0.0.0.5.116, update to version 5.0.0.0.5.116 or later to resolve the issue.

Correção

Protection Mechanism Failure

Enumeração de Fraquezas

CWE-693

Identificadores relacionados

CVE-2019-3741

Produtos afetados

Dell Emc Unity

Unisphere

Unityvsa

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-3741 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-3741 · Aviso do Fabricante
• https://productsecurity-ux.ausmp1z1.pcf.dell.com/support/security/us/en/04/details/535028/DSA-2019-086-Dell-EMC-Unity-Family-Multiple-Vulnerabilities · Aviso do Fabricante