CVE-2020-29502

Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account.

CVSS v3 7.5 HIGH
CVSS v2.0 4.6 MEDIUM

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 0.8 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://www.dell.com/support/kbdoc/000180775	Vendor Advisory
https://www.dell.com/support/kbdoc/000180775	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:dell:emc_powerstore_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:dell:emc_powerstore:-:*:*:*:*:*:*:*

History

21 Nov 2024, 05:24

Type	Values Removed	Values Added
CVSS	v2 : ~~4.6~~ v3 : ~~6.7~~	v2 : 4.6 v3 : 7.5
References	~~() https://www.dell.com/support/kbdoc/000180775 - Vendor Advisory~~	() https://www.dell.com/support/kbdoc/000180775 - Vendor Advisory

Information

Published : 2021-01-05 22:15

Updated : 2024-11-21 05:24

NVD link : CVE-2020-29502

Mitre link : CVE-2020-29502

CVE.ORG link : CVE-2020-29502

JSON object : View

Products Affected

dell

emc_powerstore
emc_powerstore_firmware

CWE

CWE-312

Cleartext Storage of Sensitive Information

{"id": "CVE-2020-29502", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "security_alert@emc.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 0.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}]}, "published": "2021-01-05T22:15:14.173", "references": [{"url": "https://www.dell.com/support/kbdoc/000180775", "tags": ["Vendor Advisory"], "source": "security_alert@emc.com"}, {"url": "https://www.dell.com/support/kbdoc/000180775", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security_alert@emc.com", "description": [{"lang": "en", "value": "CWE-312"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-312"}]}], "descriptions": [{"lang": "en", "value": "Dell EMC PowerStore versions prior to 1.0.3.0.5.007 contain a Plain-Text Password Storage Vulnerability in PowerStore X & T environments. A locally authenticated attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application with privileges of the compromised account."}, {"lang": "es", "value": "Dell EMC PowerStore versiones anteriores a 1.0.3.0.5.007, contienen una vulnerabilidad de Almacenamiento de Contrase\u00f1a de Texto Plano en entornos PowerStore X & T. Un atacante autenticado localmente podr\u00eda potencialmente explotar esta vulnerabilidad, conllevando a la divulgaci\u00f3n de determinadas credenciales de usuario. El atacante puede ser capaz de usar las credenciales expuestas para acceder a la aplicaci\u00f3n vulnerable con los privilegios de la cuenta comprometida"}], "lastModified": "2024-11-21T05:24:07.843", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:dell:emc_powerstore_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "ACAD7499-DC3D-43B8-A140-6CFC103ECE85", "versionEndExcluding": "1.0.3.0.5.007"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:dell:emc_powerstore:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "59A3CB64-B683-4F9E-82D7-B6F8A3445366"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "security_alert@emc.com"}