CVE-2017-8001 Information disclosure in EMC ScaleIO EMC ScaleIO 2.0.1.x
Unprivileged users can read temporary log files to recover clear-text credentials of the ScaleIO MDM user, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-8001?
CVE-2017-8001 is a high-severity vulnerability in EMC ScaleIO EMC ScaleIO 2.0.1.x, published on 28 Nov 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An issue was discovered in EMC ScaleIO 2.0.1.x. In a Linux environment, one of the support scripts saves the credentials of the ScaleIO MDM user who executed the script in clear text in temporary log files. The temporary files may potentially be read by an unprivileged user with access to the server where the script was executed to recover exposed credentials.
Weakness: CWE-532
Which versions are affected by CVE-2017-8001?
It affects 1 product.
Products include Dell Emc Scaleio.
How do I fix CVE-2017-8001?
No fix has been published for CVE-2017-8001 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-8001 being exploited?
There is no known exploitation of CVE-2017-8001 in the wild and no public exploit code.
Other vulnerabilities in EMC ScaleIO EMC ScaleIO 2.0.1.x
Sources
Also known as GHSA-xpjw-f7rh-9w56.