CVE-2021-21591

Vulnerability

Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.1.0.0.5.394 contain a plain-text password storage vulnerability. The software stores passwords in an unencrypted form, making them accessible to a local user with high privileges. This affects all versions before the fixed release.

Exploitation

An attacker must have local access to the system and possess high privileges (e.g., Service user). With these privileges, the attacker can read the stored plain-text passwords from the system. No user interaction is required beyond gaining the necessary local access.

Impact

Successful exploitation allows the attacker to obtain the plain-text password of another user. The attacker can then use that password to gain access with the privileges of the compromised user, potentially leading to unauthorized access to sensitive data or further system compromise. The CVSS score is 6.4 (Medium) with vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.

Mitigation

Dell has released version 5.1.0.0.5.394 which addresses this vulnerability. Users should upgrade to this version or later. No workarounds are mentioned in the advisory. The advisory is DSA-2021-139 [1].