7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
0.005 Low
EPSS
Percentile
76.1%
Security bulletin: Authentication bypass vulnerability in IBM SAN Volume Controller and Storwize Family (CVE-2012-6354)
Administrative access to the system via the GUI may be obtained without supplying proper credentials.
CVE****ID:
CVE-2012-6354
DESCRIPTION:
The vulnerability can be exploited by a user with access to the system’s management IP interface. If successful the user can gain access with superuser privilege which will allow any modification to the configuration, including complete deletion.
CVSS:
CVSS Base Score: 7.5
CVSS Temporal Score: See <http://xforce.iss.net/xforce/xfdb/80716> for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:P/A:P)
IBM SAN Volume Controller
Storwize V7000 for Lenovo
Storwize V5000 for Lenovo
Storwize V3700 for Lenovo
Storwize V3500 for Lenovo
All products affected when running a version below V6.4.1.7 or V7.1.0.6.
For IBM SAN Volume Controller, Storwize V7000, V5000, V3700 and V3500 for Lenovo and IBM Flex System V7000, install PTF level 7.1.0.1, 6.4.1.3, 6.3.0.7 or 6.2.0.6.
Access to the system’s IP interface can be restricted, for example using a private network or firewall technology. Only users with access to the IP interface can exploit the vulnerability.