Lucene search

[email protected]CVE-2018-1438

HistoryMay 17, 2018 - 9:29 p.m.

CVE-2018-1438

2018-05-1721:29:00

CWE-200

[email protected]

web.nvd.nist.gov

ibm

san volume controller

storwize

spectrum virtualize

flashsystem

vulnerability

cve-2018-1438

file read

unauthenticated access

security advisory

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.7%

JSON

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) web handler /DLSnap could allow an unauthenticated attacker to read arbitrary files on the system. IBM X-Force ID: 139566.

Affected configurations

NVD

Node

ibmstorwize_v7000_firmwareRange6.1.0.0–7.5.0.14

ibmstorwize_v7000_firmwareRange7.7.0.0–7.7.1.9

ibmstorwize_v7000_firmwareRange7.8.0.0–7.8.1.6

ibmstorwize_v7000_firmwareRange8.1.1.0–8.1.1.2

ibmstorwize_v7000_firmwareRange8.1.2.0–8.1.2.1

AND

ibmstorwize_v7000Match-

Node

ibmstorwize_v5000_firmwareRange6.1.0.0–7.5.0.14

ibmstorwize_v5000_firmwareRange7.7.0.0–7.7.1.9

ibmstorwize_v5000_firmwareRange7.8.0.0–7.8.1.6

ibmstorwize_v5000_firmwareRange8.1.1.0–8.1.1.2

ibmstorwize_v5000_firmwareRange8.1.2.0–8.1.2.1

AND

ibmstorwize_v5000Match-

Node

ibmstorwize_v3700_firmwareRange6.1.0.0–7.5.0.14

ibmstorwize_v3700_firmwareRange7.7.0.0–7.7.1.9

ibmstorwize_v3700_firmwareRange7.8.0.0–7.8.1.6

ibmstorwize_v3700_firmwareRange8.1.1.0–8.1.1.2

ibmstorwize_v3700_firmwareRange8.1.2.0–8.1.2.1

AND

ibmstorwize_v3700Match-

Node

ibmstorwize_v3500_firmwareRange6.1.0.0–7.5.0.14

ibmstorwize_v3500_firmwareRange7.7.0.0–7.7.1.9

ibmstorwize_v3500_firmwareRange7.8.0.0–7.8.1.6

ibmstorwize_v3500_firmwareRange8.1.1.0–8.1.1.2

ibmstorwize_v3500_firmwareRange8.1.2.0–8.1.2.1

AND

ibmstorwize_v3500Match-

Node

ibmstorwize_v9000_firmwareRange6.1.0.0–7.5.0.14

ibmstorwize_v9000_firmwareRange7.7.0.0–7.7.1.9

ibmstorwize_v9000_firmwareRange7.8.0.0–7.8.1.6

ibmstorwize_v9000_firmwareRange8.1.1.0–8.1.1.2

ibmstorwize_v9000_firmwareRange8.1.2.0–8.1.2.1

AND

ibmstorwize_v9000Match-

Node

ibmsan_volume_controller_firmwareRange6.1.0.0–7.5.0.14

ibmsan_volume_controller_firmwareRange7.7.0.0–7.7.1.9

ibmsan_volume_controller_firmwareRange7.8.0.0–7.8.1.6

ibmsan_volume_controller_firmwareRange8.1.1.0–8.1.1.2

ibmsan_volume_controller_firmwareRange8.1.2.0–8.1.2.1

AND

ibmsan_volume_controllerMatch-

Node

ibmspectrum_virtualizeRange6.1.0.0–7.5.0.14

ibmspectrum_virtualizeRange7.7.0.0–7.7.1.9

ibmspectrum_virtualizeRange7.8.0.0–7.8.1.6

ibmspectrum_virtualizeRange8.1.1.0–8.1.1.2

ibmspectrum_virtualizeRange8.1.2.0–8.1.2.1

Node

ibmspectrum_virtualize_for_public_cloudRange6.1.0.0–7.5.0.14

ibmspectrum_virtualize_for_public_cloudRange7.7.0.0–7.7.1.9

ibmspectrum_virtualize_for_public_cloudRange7.8.0.0–7.8.1.6

ibmspectrum_virtualize_for_public_cloudRange8.1.1.0–8.1.1.2

ibmspectrum_virtualize_for_public_cloudRange8.1.2.0–8.1.2.1

CPENameOperatorVersion
ibm:storwize_v7000_firmwareibm storwize v7000 firmwarelt7.5.0.14
ibm:storwize_v7000_firmwareibm storwize v7000 firmwarelt7.7.1.9
ibm:storwize_v7000_firmwareibm storwize v7000 firmwarelt7.8.1.6
ibm:storwize_v7000_firmwareibm storwize v7000 firmwarelt8.1.1.2
ibm:storwize_v7000_firmwareibm storwize v7000 firmwarelt8.1.2.1

CPE	Name	Operator	Version
ibm:storwize_v7000_firmware	ibm storwize v7000 firmware	lt	7.5.0.14
ibm:storwize_v7000_firmware	ibm storwize v7000 firmware	lt	7.7.1.9
ibm:storwize_v7000_firmware	ibm storwize v7000 firmware	lt	7.8.1.6
ibm:storwize_v7000_firmware	ibm storwize v7000 firmware	lt	8.1.1.2
ibm:storwize_v7000_firmware	ibm storwize v7000 firmware	lt	8.1.2.1

References

www.ibm.com/support/docview.wss?uid=ssg1S1012263

www.ibm.com/support/docview.wss?uid=ssg1S1012282

www.ibm.com/support/docview.wss?uid=ssg1S1012283

www.securityfocus.com/bid/104349

exchange.xforce.ibmcloud.com/vulnerabilities/139566

5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7.7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

68.7%

JSON

Related for CVE-2018-1438

prion1 cvelist1 nvd1 ibm4 zdt1 packetstorm1