CVE-2019-18576 Information disclosure in XtremIO
Local users can read OS passwords from log files to gain unauthorized access to Dell EMC XtremIO systems.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-18576?
CVE-2019-18576 is a medium-severity vulnerability in Dell XtremIO, published on 13 Mar 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords are logged in local files. Malicious local users with access to the log files may use the exposed passwords to gain access to XtremIO with the privileges of the compromised user.
Weakness: CWE-532
Which versions are affected by CVE-2019-18576?
It affects 1 product.
Products include Dell Xtremio Management Server.
How do I fix CVE-2019-18576?
No fix has been published for CVE-2019-18576 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-18576 being exploited?
There is no known exploitation of CVE-2019-18576 in the wild and no public exploit code.
Other vulnerabilities in Dell XtremIO
Sources
Also known as GHSA-w8m5-fpqq-3q33.