vulnwire
8.4high

CVE-2017-8001

An issue was discovered in EMC ScaleIO 2.0.1.x.

Published 8 y ago · modified 4 mo ago · JSON

CVSS
8.4
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.4%
percentile 31%
Public exploits
0
none known

An issue was discovered in EMC ScaleIO 2.0.1.x. In a Linux environment, one of the support scripts saves the credentials of the ScaleIO MDM user who executed the script in clear text in temporary log files. The temporary files may potentially be read by an unprivileged user with access to the server where the script was executed to recover exposed credentials.

Exploit prediction (EPSS)

0.37% probability of exploitation in the next 30 days, higher than 31% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.18.4CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.02.1AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • n/a EMC ScaleIO EMC ScaleIO 2.0.1.x

Classification

Weakness
  • CWE-532 Insertion of Sensitive Information into Log File

References

  • securityfocus.com /bid/101997 · vdb-entry, x_refsource_BID, x_transferred
  • seclists.org /fulldisclosure/2017/Nov/35 · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.