Dell CSM Hard-Coded Credentials Information Disclosure

Executive Summary

Dell Container Storage Modules before version 1.18.0 has a hard-coded credentials issue in the csm-docs component. An attacker without authentication can remotely exploit this to access sensitive information.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves hard-coded credentials in Dell Container Storage Modules versions prior to 1.18.0. To detect it, check the installed version of the module using commands like 'kubectl get pods' or 'helm list' to identify running instances. Inspect configuration files for hard-coded credentials in environment variables or secrets.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow unauthorized access to confidential data, potentially leading to data breaches or leaks. Systems using affected versions may expose sensitive information to attackers.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized information disclosure, which may violate data protection requirements under GDPR and HIPAA. Unauthorized access to sensitive data could result in non-compliance with these regulations, potentially leading to legal penalties or reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Update Dell Container Storage Modules to version 1.18.0 or later to address the hard-coded credentials vulnerability. Remove any exposed sensitive credentials and restrict remote access to the csm-docs component.

Useful 0 Not Useful 0