PT-2021-11226 · Dell · Dell Emc Unity+2

Published 2021-01-05 · Updated 2021-01-08 · CVE-2020-26199

Positive Technologies (AI Summary)

CVSS v3.1

6.7

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012

Description: The issue concerns a plain-text password storage vulnerability. A user's credentials, including the Unisphere admin privilege user's password, are stored in plain text in multiple log files. A local authenticated attacker with access to the log files may use the exposed password to gain access with the privileges of the compromised user.

Recommendations: For versions prior to 5.0.4.0.5.012, update to version 5.0.4.0.5.012 or later to resolve the issue. As a temporary workaround, consider restricting access to the log files to minimize the risk of exploitation. Additionally, ensure that all users with access to the log files have the least privileges necessary to perform their tasks.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2020-26199

Affected Products

Dell Emc Unity

Unity Xt

Unityvsa

References · 5

• https://dell.com/support/kbdoc/000181248 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26199 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26199 · Security Note
• https://t.me/cvenotify/8345 · Telegram Post
• https://t.me/cibsecurity/21648 · Telegram Post