Information disclosure in Dell Emc Scaleio
CVE-2017-8001
An issue was discovered in EMC ScaleIO 2.0.1.x. In a Linux environment, one of the support scripts saves the credentials of the ScaleIO MDM user who executed the script in clear text in temporary log files. The temporary files may potentially be read by an unprivileged user with access to the server where the script was executed to recover exposed credentials.
EPSS: 0.004 (29.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Dell Emc_scaleio — versions 2.0.1.0, 2.0.1.1, 2.0.1.2
- Linux Linux_kernel
- N/a Emc Scaleio 2.0.1.x — versions EMC ScaleIO EMC ScaleIO 2.0.1.x
Weakness classification (CWE)
References
- security_alert@emc.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- security_alert@emc.com (x_refsource_CONFIRM, Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2017-8001?
- CVE-2017-8001 is a high-severity vulnerability in Dell Emc Scaleio, classified under Insertion of Sensitive Information into Log File. CVSS score: 8.4/10. Published 2017-11-28.
- How severe is CVE-2017-8001?
- High severity. CVSS v3 base score is 8.4 out of 10.