CVE-2018-1241

Published: May 29, 2018Modified: Nov 21, 2024

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, under certain conditions, may leak LDAP password in plain-text into the RecoverPoint log file. An authenticated malicious user with access to the RecoverPoint log files may obtain the exposed LDAP password to use it in further attacks.

Affected (2)

Products: Emc: Recoverpoint, Recoverpoint For Virtual Machines

2 products

Recoverpoint For Virtual Machines

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Emc Recoverpoint	Before 5.1.2
Emc Recoverpoint For Virtual Machines	Before 5.1.1.3

Related CWEs

Insertion of Sensitive Information into Log File

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (4)

http://seclists.org/fulldisclosure/2018/May/61

Source: security_alert@emc.com

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/104246

Source: security_alert@emc.com

Third Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2018/May/61

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://www.securityfocus.com/bid/104246

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.