Terraform Provider For Ome
Monthly
Information exposure in the Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, occurs when the provider's API client error-handling path writes sensitive information into an externally accessible file or directory (CWE-209). Dell rates this CVSS 3.1 8.6 (High) with a remote, unauthenticated vector (AV:N/PR:N/UI:N/S:U/C:H/I:L/A:L), but independent assessment maps realistic exploitation to AV:L/AC:L/PR:N/UI:N/C:H/I:N/A:N, because an attacker must already be able to read wherever the provider's error output is persisted - typically shared log aggregation, publicly readable CI/CD output, or exposed Terraform state/debug artifacts - rather than reaching a directly network-exposed service. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor's AV:N vector should be validated against Dell DSA-2026-434 before treating this as a remotely exploitable unauthenticated issue.
Dell Terraform Provider for OME versions 1.0.0 through 1.2.3 inserts sensitive provider configuration data into log files, so an authenticated, low-privileged remote attacker who can read those logs may obtain limited confidential information about the managed environment. Scored 4.3 (Medium) as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, the issue requires prior low-level access plus reachability of the log destination, with no integrity or availability impact. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is reported, so practical risk is governed by what the provider actually writes to logs and how tightly log retention and access are controlled.
Information exposure in the Dell Terraform Provider for OME, versions 1.0.0 through 1.2.3, occurs when the provider's API client error-handling path writes sensitive information into an externally accessible file or directory (CWE-209). Dell rates this CVSS 3.1 8.6 (High) with a remote, unauthenticated vector (AV:N/PR:N/UI:N/S:U/C:H/I:L/A:L), but independent assessment maps realistic exploitation to AV:L/AC:L/PR:N/UI:N/C:H/I:N/A:N, because an attacker must already be able to read wherever the provider's error output is persisted - typically shared log aggregation, publicly readable CI/CD output, or exposed Terraform state/debug artifacts - rather than reaching a directly network-exposed service. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the vendor's AV:N vector should be validated against Dell DSA-2026-434 before treating this as a remotely exploitable unauthenticated issue.
Dell Terraform Provider for OME versions 1.0.0 through 1.2.3 inserts sensitive provider configuration data into log files, so an authenticated, low-privileged remote attacker who can read those logs may obtain limited confidential information about the managed environment. Scored 4.3 (Medium) as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, the issue requires prior low-level access plus reachability of the log destination, with no integrity or availability impact. No public exploit code has been identified at time of analysis, and no confirmed active exploitation is reported, so practical risk is governed by what the provider actually writes to logs and how tightly log retention and access are controlled.