Lucene search

K
ibmIBME56288EDC7334DB7071F8CD6CA5FDC34E7640BBDBAA8DE26D5CF6ED392AED43B
HistoryMar 29, 2023 - 1:48 a.m.

Security Bulletin: Multiple vulnerabilities in Apache Struts affect SAN Volume Controller, Storwize family and FlashSystem V9000 products

2023-03-2901:48:02
www.ibm.com
25
apache struts vulnerabilities
san volume controller
storwize family
flashsystem v9000
cross-site request forgery
security restrictions bypass
unspecified error vulnerability
upgrade
ibm products

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.024 Low

EPSS

Percentile

89.9%

Summary

Open Source Apache Struts vulnerabilities were disclosed in Jun 2016. Struts is used by SAN Volume Controller, Storwize family and FlashSystem V9000 products in their Service Assistant GUI. The CVEs are CVE-2016-4430 CVE-2016-4431 CVE-2016-4433 CVE-2016-4436.

Vulnerability Details

CVEID: CVE-2016-4430**
DESCRIPTION:** Apache Struts is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated user to visit a malicious Web site, a remote attacker could send a malformed expression to bypass token validation. An attacker could exploit this vulnerability to perform cross-site scripting attacks, Web cache poisoning, and other malicious activities.
CVSS Base Score: 8.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114185 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

CVEID: CVE-2016-4431**
DESCRIPTION:** Apache Struts could allow a remote attacker to bypass security restrictions, caused by an error in the default action method. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass internal security mechanism and redirect the victim to an arbitrary site.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114187 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID: CVE-2016-4433**
DESCRIPTION:** Apache Struts could allow a remote attacker to bypass security restrictions, caused by an error in the Getter as action method. By sending a specially crafted request, an attacker could exploit this vulnerability to bypass internal security mechanism and redirect the victim to an arbitrary site.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114186 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID: CVE-2016-4436**
DESCRIPTION:** An unspecified error Apache Struts related to the method used to clean up action name has an unknown impact and attack vector.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/114183 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

IBM SAN Volume Controller
IBM Storwize V7000
IBM Storwize V5000
IBM Storwize V3700
IBM Storwize V3500
IBM FlashSystem V9000

All products are affected when running supported releases 1.1 to 7.7.

Remediation/Fixes

IBM recommends that you fix this vulnerability by upgrading affected versions of IBM SAN Volume Controller, IBM Storwize V7000, V5000, V3700 and V3500 to the following code levels or higher:

7.5.0.10
7.6.1.5
7.7.0.3
7.7.1.2

Latest SAN Volume Controller Code
Latest Storwize V7000 Code
Latest Storwize V5000 Code
Latest Storwize V3700 Code
Latest Storwize V3500 Code

For IBM FlashSystem V9000, upgrade to the following code levels or higher:

7.5.1.6
7.6.1.5
7.7.0.3
7.7.1.2

Latest FlashSystem V9000 Code

Workarounds and Mitigations

Although IBM recommends that you install a level of code with a fix for this vulnerability, you can mitigate, although not eliminate, your risk until you have done so by ensuring that all users who have access to the system are authenticated by another security system such as a firewall.

Affected configurations

Vulners
Node
ibmstorwize_v7000Match6.1
OR
ibmstorwize_v7000Match6.2
OR
ibmstorwize_v7000Match6.3
OR
ibmstorwize_v7000Match6.4
OR
ibmstorwize_v7000Match7.1
OR
ibmstorwize_v7000Match7.2
OR
ibmstorwize_v7000Match7.3
OR
ibmstorwize_v7000Match7.4
OR
ibmstorwize_v7000Match7.5
OR
ibmstorwize_v7000Match7.6
OR
ibmstorwize_v7000Match7.6.1
OR
ibmstorwize_v7000Match7.7
OR
ibmstorwize_v3500Match6.4
OR
ibmstorwize_v3500Match7.1
OR
ibmstorwize_v3500Match7.2
OR
ibmstorwize_v3500Match7.3
OR
ibmstorwize_v3500Match7.4
OR
ibmstorwize_v3500Match7.5
OR
ibmstorwize_v3700Match6.4
OR
ibmstorwize_v3700Match7.1
OR
ibmstorwize_v3700Match7.2
OR
ibmstorwize_v3700Match7.3
OR
ibmstorwize_v3700Match7.4
OR
ibmstorwize_v3700Match7.5
OR
ibmstorwize_v5000Match7.1
OR
ibmstorwize_v5000Match7.2
OR
ibmstorwize_v5000Match7.3
OR
ibmstorwize_v5000Match7.4
OR
ibmstorwize_v5000Match7.5
OR
ibmsan_volume_controllerMatch6.1
OR
ibmsan_volume_controllerMatch6.2
OR
ibmsan_volume_controllerMatch6.3
OR
ibmsan_volume_controllerMatch6.4
OR
ibmsan_volume_controllerMatch7.1
OR
ibmsan_volume_controllerMatch7.2
OR
ibmsan_volume_controllerMatch7.3
OR
ibmsan_volume_controllerMatch7.4
OR
ibmsan_volume_controllerMatch7.5
OR
ibmflashsystem_v9000Match7.1
OR
ibmflashsystem_v9000Match7.2
OR
ibmflashsystem_v9000Match7.3
OR
ibmflashsystem_v9000Match7.4
OR
ibmflashsystem_v9000Match7.5

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.024 Low

EPSS

Percentile

89.9%

Related for E56288EDC7334DB7071F8CD6CA5FDC34E7640BBDBAA8DE26D5CF6ED392AED43B