PT-2017-18059 · Emc · Scaleio

David Berard · Published 2017-11-28 · Updated 2019-11-14 · CVE-2017-8001

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EMC ScaleIO version 2.0.1.x

Description An issue was discovered where a support script in a Linux environment saves the credentials of the ScaleIO MDM user in clear text in temporary log files. These temporary files may be read by an unprivileged user with access to the server to recover exposed credentials.

Recommendations For EMC ScaleIO version 2.0.1.x, consider restricting access to the temporary log files generated by the support script to prevent unauthorized users from reading the exposed credentials. As a temporary workaround, restrict access to the server where the script was executed to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2017-8001

Affected Products

Scaleio

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-8001 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8001 · Vendor Advisory
• http://seclists.org/fulldisclosure/2017/Nov/35 · Note
• http://securityfocus.com/bid/101997 · Note