CVE-2025-43937
Sensitive Information Exposure in Dell PowerScale OneFS Logs
Publication date: 2026-04-16
Last updated on: 2026-04-21
Assigner: Dell
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dell | powerscale_onefs | From 9.11.0.0 (inc) to 9.12.0.0 (exc) |
| dell | powerscale_onefs | to 9.5.1.5 (exc) |
| dell | powerscale_onefs | From 9.6.0.0 (inc) to 9.7.1.10 (exc) |
| dell | powerscale_onefs | From 9.8.0.0 (inc) to 9.10.1.3 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Dell PowerScale OneFS versions prior to 9.12.0.0 and involves the insertion of sensitive information into log files.
A low privileged attacker with local access could exploit this issue to disclose certain user credentials.
The attacker may then use these exposed credentials to access the vulnerable application with the privileges of the compromised account.
How can this vulnerability impact me? :
The vulnerability can lead to the disclosure of sensitive user credentials to an attacker with local access and low privileges.
This could allow the attacker to gain unauthorized access to the application with the compromised user's privileges.
Such unauthorized access could result in significant impact, including potential data exposure or disruption of services.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves the insertion of sensitive information into log files, which can lead to the disclosure of user credentials. Such exposure of sensitive data could potentially impact compliance with data protection regulations like GDPR and HIPAA, which require the protection of personal and sensitive information.
If attackers exploit this vulnerability to access user credentials and gain unauthorized access, it may result in violations of confidentiality and data security requirements mandated by these standards.