Lucene search

IbmCVE-2024-38324

HistorySep 25, 2024 - 1:15 a.m.

CVE-2024-38324

2024-09-2501:15:40

CWE-297

ibm

web.nvd.nist.gov

ibm

storage defender

certificate validation

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

37.6%

JSON

IBM Storage Defender 2.0.0 through 2.0.7 on-prem defender-sensor-cmd CLI does not validate server name during registration and unregistration operations which could expose sensitive information to an attacker with access to the system.

Affected configurations

Vulners

Node

ibmstorage_defender_resiliency_serviceRange2.0.0–2.0.7

VendorProductVersionCPE
ibmstorage_defender_resiliency_service*cpe:2.3:a:ibm:storage_defender_resiliency_service:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	storage_defender_resiliency_service	*	cpe:2.3:a:ibm:storage_defender_resiliency_service::::::::

CNA Affected

[
  {
    "cpes": [
      "cpe:2.3:a:ibm:storage_defender_resiliency_service:2.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:storage_defender_resiliency_service:2.0.7:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "Storage Defender - Resiliency Service",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "2.0.7",
        "status": "affected",
        "version": "2.0.0",
        "versionType": "semver"
      }
    ]
  }
]

References

www.ibm.com/support/pages/node/7168640

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

AI Score

5.5

Confidence

High

EPSS

0.001

Percentile

37.6%

JSON

Related for CVE-2024-38324