CVE-2023-25681

IBM Spectrum Virtualize 8.5 (CVE-2023-25681) permits LDAP-authenticated users configured for MFA to access the CIM interface using only a username and password, bypassing MFA. The issue affects CIM authentication and does not apply to local MFA users or SSO-enabled remote users. Red Hat and CVE l...

PT-2024-12068 · Ibm · Ibm Spectrum Virtualize

Name of the Vulnerable Software and Affected Versions: IBM Spectrum Virtualize version 8.5 Description: The issue allows LDAP users configured to require multifactor authentication to authenticate to the CIM interface using only a username and password. This does not affect local users with MFA...

IBM Spectrum Virtualize Security Vulnerability

IBM Spectrum Virtualize is a block storage virtualization system from International Business Machines IBM, Inc. that improves the data value, security and simplicity of new and existing storage infrastructures. A security vulnerability exists in IBM Spectrum Virtualize version 8.5 that stems from...

Design/Logic Flaw

IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.6 products could allow a remote attacker to spoof a trusted system that would not be correctly validated by the Storwize server. This could lead to a user connecting to a malicious host, believing that it was a...

CVE-2023-47700 IBM Storage Virtualize improper certificate validation

IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.6 products could allow a remote attacker to spoof a trusted system that would not be correctly validated by the Storwize server. This could lead to a user connecting to a malicious host, believing that it was a...

CVE-2023-47700

CVE-2023-47700 affects IBM Storage Virtualize family (IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem, IBM Storage Virtualize) on version 8.6. The issue = a trust management/GUI certificate validation flaw that could allow a remote attacker to spoof a trusted system, causing a user to co...

CVE-2023-47700 IBM Storage Virtualize improper certificate validation

IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.6 products could allow a remote attacker to spoof a trusted system that would not be correctly validated by the Storwize server. This could lead to a user connecting to a malicious host, believing that it was a...

Security Bulletin: An unauthenticated user can determine whether the default superuser password has been changed on IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize products

Summary An unauthenticated user can determine whether the default superuser password has been changed on IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize products. This only affects the 8.3.1 release as it is impossible for the default password to still be...

CVE-2023-43042

IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.3 products use default passwords for a privileged user. IBM X-Force ID: 266874...

CVE-2023-43042 IBM Storage Virtualize information disclosure

IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.3 products use default passwords for a privileged user. IBM X-Force ID: 266874...

Security Bulletin: Vulnerabilities in IBM Java affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

Summary Vulnerabilities in IBM® Runtime Environment Java™ Technology Edition affects the product's management GUI. The Command Line Interface is unaffected. Vulnerability Details CVEID:CVE-2023-21930 DESCRIPTION: An unspecified vulnerability in Oracle Java SE, Oracle GraalVM Enterprise Edition...

Security Bulletin: A vulnerability in Apache Struts affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

Summary A vulnerability in Apache Struts affects the product's management GUI. The Command Line Interface is unaffected. Vulnerability Details CVEID:CVE-2023-34396 DESCRIPTION: Apache Struts is vulnerable to a denial of service, caused by a flaw when processing Multipart request containing non-fi...

The vulnerability of the graphical interface of Spectrum Virtualize software lies in the insufficient protection of operational data, which allows attackers to execute arbitrary code and enhance their privileges.

The vulnerability of the graphical interface of Spectrum Virtualize software lies in the insufficient protection of operational data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code and gain increased privileges...

The vulnerability of the SNMPv3 software for Virtualize Spectrum virtualization allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the SNMPv3 software for Virtualize Spectrum virtualization lies in the ability to disclose information through registration files. Exploiting this vulnerability can allow a malicious actor to gain unauthorized access to protected information...

Security Bulletin: Storage Virtualize ansible collection is affected by a vulnerability in the Python Cryptographic Authority package [CVE-2023-38325]

Summary The Python Cryptographic Authority package is used by paramiko, a third party library, which is used by Ansible collection for Storage Virtualize for authentication to target systems. This library is vulnerable to CVE-2023-38325. Vulnerability Details CVEID:CVE-2023-38325 DESCRIPTION:...

Security Bulletin: IBMid credentials may be exposed when directly downloading code onto IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Spectrum Virtualize products [CVE-2023-27870]

Summary If using the "satask downloadsoftware" command or the "Obtain the package directly" option in the GUI to update the system on IBM SAN Volume Controller, IBM Storwize and IBM FlashSystem products which run IBM Spectrum Virtualize software, the IBMid credentials used to authenticate to Fix...

IBM Spectrum Virtualize Information Disclosure Vulnerability (CNVD-2023-40603)

IBM Spectrum Virtualize is a block storage virtualization system from International Business Machines IBM, Inc. that increases the data value, security and simplicity of new and existing storage infrastructures. An information disclosure vulnerability exists in IBM Spectrum Virtualize version 8.5...

CVE-2023-27870

IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress. IBM X-Force ID: 249518...

CVE-2023-27870

IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress. IBM X-Force ID: 249518...

Information disclosure

IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress. IBM X-Force ID: 249518...