Lucene search

K
ibmIBM0EF4B59393438EACFD8FC2C07DD8F070A3FBCF00E78AF631B2B3CB8138D69697
HistoryFeb 18, 2023 - 1:45 a.m.

Security Bulletin: A vulnerability in Apache Tomcat affects the IBM FlashSystem 840 and 900

2023-02-1801:45:50
www.ibm.com
18
tomcat vulnerability
flashsystem 840
flashsystem 900
remote attacker
phishing attacks
open redirect
code fix
ibm fix central

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

0.791 High

EPSS

Percentile

98.3%

Summary

A vulnerability exists in Apache Tomcat to which the IBM FlashSystem™ 840 and FlashSystem 900 are susceptible (CVE-2018-11784). An exploit of this vulnerability could allow a remote attacker to redirect a user to arbitrary websites.

Vulnerability Details

CVEID: CVE-2018-11784 DESCRIPTION: Apache Tomcat could allow a remote attacker to conduct phishing attacks, caused by an open redirect vulnerability in the default servlet. An attacker could exploit this vulnerability using a specially-crafted URL to redirect a victim to arbitrary Web sites.
CVSS Base Score: 7.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/150860&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)

Affected Products and Versions

FlashSystem 840 machine type and models (MTMs) affected include 9840-AE1 and 9843-AE1.
FlashSystem 900 MTMs affected include 9843-UF3, 9840-AE2, 9843-AE2, 9840-AE3, and 9843-AE3.

Supported code versions which are affected

  • VRMFs prior to 1.4.8.2
  • VRMFs prior to 1.5.2.5
  • VRMFs prior to 1.6.1.0

Remediation/Fixes

MTMs

| VRMF | APAR | Remediation/First Fix
—|—|—|—
FlashSystem****840 MTM:
9840-AE1 &9843-AE1

**FlashSystem 900 MTMs:**9843-UF3, 9840-AE2, 9843-AE2, 9840-AE3, & 9843-AE3 |

Code fixes are now available, the minimum VRMF containing the fix depends on the code stream:_ _
__Fixed Code VRMF __
1.6 stream: 1.6.1.0

1.5 stream: 1.5.2.5

1.4 stream: 1.4.8.2

| N/A | FlashSystem 840 fixesand FlashSystem 900 fixes****are available @ IBM’s Fix Central

Workarounds and Mitigations

Upgrade to a remediated code level.

Affected configurations

Vulners
Node
ibmflashsystem_900Matchany
OR
ibmflashsystem_900Matchany

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

0.791 High

EPSS

Percentile

98.3%