Lucene search

IBM3CBC2D3C6C59A765D1DAC08461460ABA69BC9F7B530D39C8E3B81608EC4B9295

HistoryMay 25, 2022 - 11:01 p.m.

Security Bulletin: IBM Elastic Storage System 3000 GUI is affected by verbose error message (CVE-2020-4357)

2022-05-2523:01:32

www.ibm.com

ibm

elastic storage system

gui

vulnerability

cve-2020-4357

fix

available

ibm x-force

spectrum scale

remote attacker

sensitive information

browser

cvss

5.0.0.0

5.0.4.4

6.0.0

6.0.0.2

v6.0.1.0

fixcentral

security bulletin

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

32.8%

JSON

Summary

A security vulnerability has been identified in all levels of IBM Elastic Storage System 3000 GUI. A fix for this vulnerability is available.

Vulnerability Details

CVEID:CVE-2020-4357
**DESCRIPTION:**IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system. IBM X-Force ID: 178761.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/178761 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Elastic Storage System 3000	6.0.0 - 6.0.0.2

Remediation/Fixes

For IBM Elastic Storage System 3000 V6.0.0 thru 6.0.0.2, apply V6.0.1.0 available from FixCentral at:

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Elastic+Storage+Server+(ESS)&release=6.0.0&platform=All&function=all

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmelastic_storage_systemMatch6.0

VendorProductVersionCPE
ibmelastic_storage_system6.0cpe:2.3:a:ibm:elastic_storage_system:6.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	elastic_storage_system	6.0	cpe:2.3:a:ibm:elastic_storage_system:6.0:::::::*

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

EPSS

0.001

Percentile

32.8%

JSON

Related for 3CBC2D3C6C59A765D1DAC08461460ABA69BC9F7B530D39C8E3B81608EC4B9295