Information Disclosure in Dell ObjectScale via Log Injection

Executive Summary

Dell ObjectScale versions before 4.3.0.1 have a vulnerability where sensitive information is logged improperly. A low-privileged local attacker could exploit this to read sensitive data from log files.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Dell ObjectScale logs for sensitive information insertion by low-privileged users. Review logs in svc_tools directories for unauthorized data exposure. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker with local access to view sensitive information stored in log files, potentially leading to data breaches or unauthorized access to confidential data.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized disclosure of personal or sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations that mandate protection of confidential information.

Useful 0 Not Useful 0

Mitigation Strategies

Update Dell ObjectScale to version 4.3.0.1 or later to address the vulnerability. Ensure only trusted users have local access to systems running ObjectScale.

Useful 0 Not Useful 0