Information disclosure in Dell EMC Scaleio
CVE-2017-8001
An issue was discovered in EMC ScaleIO 2.0.1.x. In a Linux environment, one of the support scripts saves the credentials of the ScaleIO MDM user who executed the script in clear text in temporary log files. The temporary files may potentially be read by an unprivileged user with access to the server where the script was executed to recover exposed credentials.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.4 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (28.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 28th percentile — 28.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Dell EMC Scaleio — versions 2.0.1.0, 2.0.1.1, 2.0.1.2
- Linux Kernel
- EMC Scaleio 2.0.1.x — versions EMC ScaleIO EMC ScaleIO 2.0.1.x
Weakness classification (CWE)
References
- www.securityfocus.com/bid/101997 (VDB Entry, Third Party Advisory, vdb-entry)
- seclists.org/fulldisclosure/2017/Nov/35 (Mailing List, Third Party Advisory)
Frequently asked questions
- What is CVE-2017-8001?
- CVE-2017-8001 is a high-severity vulnerability in Dell EMC Scaleio, classified under Insertion of Sensitive Information into Log File. CVSS score: 8.4/10. Published 2017-11-28.
- How severe is CVE-2017-8001?
- High severity. CVSS v3 base score is 8.4 out of 10.