IBM Spectrum Protect Plus Information Disclosure Vulnerability (CNVD-2023-41895)

IBM Spectrum Protect Plus is a suite of data protection platforms from International Business Machines (IBM). The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. An information disclosure vulnerability exists in IBM Spectrum Protect Plus Server version 10.1.13, which stems from the application’s inadequate protection of sensitive information and can be exploited by an attacker to obtain SMB credentials that can be used to access the vSnap datastore.