The vulnerability is an Insertion of Sensitive Information into Log File, as identified by CWE‑532. In the provider configuration component of the Dell Terraform Provider for OME, data that should be treated as sensitive—such as credentials or private configuration values—is written to log files that are accessible to users with low privileges. A remote attacker who can provide or modify configuration data can trigger this logging, resulting in the exposure of confidential information to an attacker who does not normally have such access. The CVSS score of 4.3 indicates a moderate risk primarily to confidentiality, with little or no impact on integrity or availability.

This issue affects Dell’s Terraform Provider for OME in all versions from 1.0.0 through 1.2.3. No other vendors or products are listed, and the vulnerability is tied specifically to the provider component that handles configuration settings.

The CVSS score of 4.3 suggests a moderate severity, and the EPSS score of 0.00269 indicates a very low probability of exploitation. The KEV status is not listed, so there is currently no evidence of widespread exploitation. The likely attack vector is remote, requiring a low‑privileged user with access to the terraform configuration, and the attacker would need to alter configuration contents to trigger the logging of sensitive data. While the probability of exploitation may be modest, the potential impact of confidential data leakage warrants prompt attention.