CVE-2020-26199

Name of the Vulnerable Software and Affected Versions: Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012

Description: The issue concerns a plain-text password storage vulnerability. A user's credentials, including the Unisphere admin privilege user's password, are stored in plain text in multiple log files. A local authenticated attacker with access to the log files may use the exposed password to gain access with the privileges of the compromised user.

Recommendations: For versions prior to 5.0.4.0.5.012, update to version 5.0.4.0.5.012 or later to resolve the issue. As a temporary workaround, consider restricting access to the log files to minimize the risk of exploitation. Additionally, ensure that all users with access to the log files have the least privileges necessary to perform their tasks.