Read the docs
TI-2019-13445 Aliases CVE-2019-18576GHSA-w8m5-fpqq-3q33

Sensitive information in log files in Dell XtremIO

Priority LOW 29CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-532.

Summary

Dell EMC XtremIO XMS versions prior to 6.3.0 contain an information disclosure vulnerability where OS users’ passwords are logged in local files. Malicious local users with access to the log files may use the exposed passwords to gain access to XtremIO with the privileges of the compromised user.

Why it matters now

EPSS 0.00309 23rd percentileScored 2026-11-07
Fix Fixed XtremIO (Dell): 6.3.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
DellXtremIObefore 6.3.06.3.0Patch availableCNA
  • XtremIO VendorDell Affected before 6.3.0 Fixed in 6.3.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dell:xtremio_management_server:*:*:*:*:*:*:*:*before 6.3.0VulnerableDell
  • cpe:2.3:a:dell:xtremio_management_server:*:*:*:*:*:*:*:* Versions before 6.3.0 Vulnerable ·Dell

Remediation

  • Fix · CNA XtremIO (Dell) Fixed in 6.3.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Dell XtremIO 6.3.0

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2019-13447 Cross-site scripting in Dell XtremIOPriority MEDIUM 41
    • TI-2019-13446 Incorrect permission assignment in Dell XtremIOPriority LOW 30
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-18576
  2. 2026-10-03 Alias added: GHSA-w8m5-fpqq-3q33

References

Advisory 1

  • TI-2022-13266 Missing brute-force protection in Dell XtremIO CVSS 3.1CRITICAL 9.8
  • TI-2019-13447 Cross-site scripting in Dell XtremIO CVSS 3.1CRITICAL 9.0
  • TI-2025-21454 Sensitive information in log files in Dell XtremIO CVSS 3.1HIGH 8.8
  • TI-2025-19298 Sensitive information in log files in Dell TechAdvisor CVSS 3.1HIGH 8.8
  • TI-2021-04634 Cross-site request forgery in Dell XtremIO CVSS 3.1HIGH 8.8
  • TI-2019-13446 Incorrect permission assignment in Dell XtremIO CVSS 3.1MEDIUM 6.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences