// For flags

CVE-2019-3741

 

Severity Score

7.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain a plain-text password storage vulnerability. A Unisphere user’s (including the admin privilege user) password is stored in a plain text in Unity Data Collection bundle (logs files for troubleshooting). A local authenticated attacker with access to the Data Collection bundle may use the exposed password to gain access with the privileges of the compromised user.

Las versiones de Dell EMC Unity y UnityVSA anteriores a la versión 5.0.0.0.5.116 contienen una vulnerabilidad de almacenamiento de contraseña de texto sin formato. La contraseña de un usuario de Unisphere (incluido el usuario con privilegios de administrador) se almacena en un texto sin formato en el paquete de Unity Data Collection (archivos de registro para la resolución de problemas). Un atacante autenticado local con acceso al paquete de recopilación de datos puede usar la contraseña expuesta para obtener acceso con los privilegios del usuario comprometido.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-01-03 CVE Reserved
  • 2019-07-18 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-09-16 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-693: Protection Mechanism Failure
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Dell
Search vendor "Dell"
 Emc Unity Operating Environment
Search vendor "Dell" for product "Emc Unity Operating Environment"
 < 5.0.0.0.5.116
Search vendor "Dell" for product "Emc Unity Operating Environment" and version " < 5.0.0.0.5.116"
-
Affected
Dell
Search vendor "Dell"
 Emc Unityvsa Operating Environment
Search vendor "Dell" for product "Emc Unityvsa Operating Environment"
 < 5.0.0.0.5.116
Search vendor "Dell" for product "Emc Unityvsa Operating Environment" and version " < 5.0.0.0.5.116"
-
Affected