PT-2019-16684 · Dell Emc · Unityvsa+2

Published 2019-07-18 · Updated 2020-02-10 · CVE-2019-3741

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116

Description The issue concerns the storage of passwords in plain text within the Unity Data Collection bundle, which includes log files for troubleshooting purposes. Specifically, a Unisphere user's password, including those with admin privileges, is stored in plain text. This could allow a local authenticated attacker with access to the Data Collection bundle to use the exposed password and gain access with the privileges of the compromised user.

Recommendations For versions prior to 5.0.0.0.5.116, update to version 5.0.0.0.5.116 or later to resolve the issue.

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2019-3741

Affected Products

Dell Emc Unity

Unisphere

Unityvsa

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-3741 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3741 · Vendor Advisory
• https://productsecurity-ux.ausmp1z1.pcf.dell.com/support/security/us/en/04/details/535028/DSA-2019-086-Dell-EMC-Unity-Family-Multiple-Vulnerabilities · Vendor Advisory