Lucene search

IBM4954161CC2267E3A00DD2DDB01452C4E7CF2F6D41C164AFC804480691418FED3

HistoryMay 25, 2022 - 11:01 p.m.

Security Bulletin: IBM Elastic Storage System 3000 is affected by cross-site scripting (CVE-2020-4358)

2022-05-2523:01:32

www.ibm.com

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

19.9%

JSON

Summary

A security vulnerability has been identified in all levels of IBM Elastic Storage System 3000 GUI. A fix for this vulnerability is available.

Vulnerability Details

CVEID:CVE-2020-4358
**DESCRIPTION:**IBM Spectrum Scale 5.0.0.0 through 5.0.4.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 178762.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/178762 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Elastic Storage System 3000	6.0.0 - 6.0.0.2

Remediation/Fixes

For IBM Elastic Storage System 3000 V6.0.0 thru 6.0.0.2, apply V6.0.1.0 available from FixCentral at:

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=Software%20defined%20storage&product=ibm/StorageSoftware/IBM+Elastic+Storage+Server+(ESS)&release=6.0.0&platform=All&function=all

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmelastic_storage_systemMatch6.0

CPENameOperatorVersion
ibm elastic storage systemeq6.0

CPE	Name	Operator	Version
	ibm elastic storage system	eq	6.0

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

19.9%

JSON

Related for 4954161CC2267E3A00DD2DDB01452C4E7CF2F6D41C164AFC804480691418FED3