CVE-2018-1466
IBM Flashsystem / Storwize CSRF / Arbitrary File Read / Information Disclosure
Severity Score
5.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) use weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 140397.
Los productos IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize e IBM FlashSystem ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1 y 8.1.1) emplean algoritmos criptográficos más débiles de lo esperado que podrían permitir que un atacante descifre información altamente sensible. IBM X-Force ID: 140397.
Vulnerabilities were identified in the IBM Flashsystem 840, IBM Flashsystem 900 and IBM Storwize V7000. They include cross site request forgery, arbitrary file read, unauthenticated access, and various other vulnerabilities.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2017-12-13 CVE Reserved
- 2018-05-14 CVE Published
- 2023-07-08 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-326: Inadequate Encryption Strength
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/104349 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.ibm.com/support/docview.wss?uid=ssg1S1012263 | 2020-08-19 | |
| http://www.ibm.com/support/docview.wss?uid=ssg1S1012282 | 2020-08-19 | |
| http://www.ibm.com/support/docview.wss?uid=ssg1S1012283 | 2020-08-19 | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/140397 | 2020-08-19 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Ibm Search vendor "Ibm" | Storwize V7000 Firmware Search vendor "Ibm" for product "Storwize V7000 Firmware" | >= 6.1.0.0 < 7.5.0.14 Search vendor "Ibm" for product "Storwize V7000 Firmware" and version " >= 6.1.0.0 < 7.5.0.14" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V7000 Search vendor "Ibm" for product "Storwize V7000" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V7000 Firmware Search vendor "Ibm" for product "Storwize V7000 Firmware" | >= 7.7.0.0 < 7.7.1.9 Search vendor "Ibm" for product "Storwize V7000 Firmware" and version " >= 7.7.0.0 < 7.7.1.9" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V7000 Search vendor "Ibm" for product "Storwize V7000" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V7000 Firmware Search vendor "Ibm" for product "Storwize V7000 Firmware" | >= 7.8.0.0 < 7.8.1.6 Search vendor "Ibm" for product "Storwize V7000 Firmware" and version " >= 7.8.0.0 < 7.8.1.6" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V7000 Search vendor "Ibm" for product "Storwize V7000" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V7000 Firmware Search vendor "Ibm" for product "Storwize V7000 Firmware" | >= 8.1.1.0 < 8.1.1.2 Search vendor "Ibm" for product "Storwize V7000 Firmware" and version " >= 8.1.1.0 < 8.1.1.2" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V7000 Search vendor "Ibm" for product "Storwize V7000" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V7000 Firmware Search vendor "Ibm" for product "Storwize V7000 Firmware" | >= 8.1.2.0 < 8.1.2.1 Search vendor "Ibm" for product "Storwize V7000 Firmware" and version " >= 8.1.2.0 < 8.1.2.1" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V7000 Search vendor "Ibm" for product "Storwize V7000" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V5000 Firmware Search vendor "Ibm" for product "Storwize V5000 Firmware" | >= 6.1.0.0 < 7.5.0.14 Search vendor "Ibm" for product "Storwize V5000 Firmware" and version " >= 6.1.0.0 < 7.5.0.14" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V5000 Search vendor "Ibm" for product "Storwize V5000" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V5000 Firmware Search vendor "Ibm" for product "Storwize V5000 Firmware" | >= 7.7.0.0 < 7.7.1.9 Search vendor "Ibm" for product "Storwize V5000 Firmware" and version " >= 7.7.0.0 < 7.7.1.9" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V5000 Search vendor "Ibm" for product "Storwize V5000" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V5000 Firmware Search vendor "Ibm" for product "Storwize V5000 Firmware" | >= 7.8.0.0 < 7.8.1.6 Search vendor "Ibm" for product "Storwize V5000 Firmware" and version " >= 7.8.0.0 < 7.8.1.6" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V5000 Search vendor "Ibm" for product "Storwize V5000" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V5000 Firmware Search vendor "Ibm" for product "Storwize V5000 Firmware" | >= 8.1.1.0 < 8.1.1.2 Search vendor "Ibm" for product "Storwize V5000 Firmware" and version " >= 8.1.1.0 < 8.1.1.2" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V5000 Search vendor "Ibm" for product "Storwize V5000" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V5000 Firmware Search vendor "Ibm" for product "Storwize V5000 Firmware" | >= 8.1.2.0 < 8.1.2.1 Search vendor "Ibm" for product "Storwize V5000 Firmware" and version " >= 8.1.2.0 < 8.1.2.1" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V5000 Search vendor "Ibm" for product "Storwize V5000" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V3700 Firmware Search vendor "Ibm" for product "Storwize V3700 Firmware" | >= 6.1.0.0 < 7.5.0.14 Search vendor "Ibm" for product "Storwize V3700 Firmware" and version " >= 6.1.0.0 < 7.5.0.14" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V3700 Search vendor "Ibm" for product "Storwize V3700" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V3700 Firmware Search vendor "Ibm" for product "Storwize V3700 Firmware" | >= 7.7.0.0 < 7.7.1.9 Search vendor "Ibm" for product "Storwize V3700 Firmware" and version " >= 7.7.0.0 < 7.7.1.9" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V3700 Search vendor "Ibm" for product "Storwize V3700" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V3700 Firmware Search vendor "Ibm" for product "Storwize V3700 Firmware" | >= 7.8.0.0 < 7.8.1.6 Search vendor "Ibm" for product "Storwize V3700 Firmware" and version " >= 7.8.0.0 < 7.8.1.6" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V3700 Search vendor "Ibm" for product "Storwize V3700" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V3700 Firmware Search vendor "Ibm" for product "Storwize V3700 Firmware" | >= 8.1.1.0 < 8.1.1.2 Search vendor "Ibm" for product "Storwize V3700 Firmware" and version " >= 8.1.1.0 < 8.1.1.2" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V3700 Search vendor "Ibm" for product "Storwize V3700" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V3700 Firmware Search vendor "Ibm" for product "Storwize V3700 Firmware" | >= 8.1.2.0 < 8.1.2.1 Search vendor "Ibm" for product "Storwize V3700 Firmware" and version " >= 8.1.2.0 < 8.1.2.1" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V3700 Search vendor "Ibm" for product "Storwize V3700" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V3500 Firmware Search vendor "Ibm" for product "Storwize V3500 Firmware" | >= 6.1.0.0 < 7.5.0.14 Search vendor "Ibm" for product "Storwize V3500 Firmware" and version " >= 6.1.0.0 < 7.5.0.14" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V3500 Search vendor "Ibm" for product "Storwize V3500" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V3500 Firmware Search vendor "Ibm" for product "Storwize V3500 Firmware" | >= 7.7.0.0 < 7.7.1.9 Search vendor "Ibm" for product "Storwize V3500 Firmware" and version " >= 7.7.0.0 < 7.7.1.9" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V3500 Search vendor "Ibm" for product "Storwize V3500" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V3500 Firmware Search vendor "Ibm" for product "Storwize V3500 Firmware" | >= 7.8.0.0 < 7.8.1.6 Search vendor "Ibm" for product "Storwize V3500 Firmware" and version " >= 7.8.0.0 < 7.8.1.6" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V3500 Search vendor "Ibm" for product "Storwize V3500" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V3500 Firmware Search vendor "Ibm" for product "Storwize V3500 Firmware" | >= 8.1.1.0 < 8.1.1.2 Search vendor "Ibm" for product "Storwize V3500 Firmware" and version " >= 8.1.1.0 < 8.1.1.2" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V3500 Search vendor "Ibm" for product "Storwize V3500" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V3500 Firmware Search vendor "Ibm" for product "Storwize V3500 Firmware" | >= 8.1.2.0 < 8.1.2.1 Search vendor "Ibm" for product "Storwize V3500 Firmware" and version " >= 8.1.2.0 < 8.1.2.1" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V3500 Search vendor "Ibm" for product "Storwize V3500" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V9000 Firmware Search vendor "Ibm" for product "Storwize V9000 Firmware" | >= 6.1.0.0 < 7.5.0.14 Search vendor "Ibm" for product "Storwize V9000 Firmware" and version " >= 6.1.0.0 < 7.5.0.14" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V9000 Search vendor "Ibm" for product "Storwize V9000" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V9000 Firmware Search vendor "Ibm" for product "Storwize V9000 Firmware" | >= 7.7.0.0 < 7.7.1.9 Search vendor "Ibm" for product "Storwize V9000 Firmware" and version " >= 7.7.0.0 < 7.7.1.9" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V9000 Search vendor "Ibm" for product "Storwize V9000" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V9000 Firmware Search vendor "Ibm" for product "Storwize V9000 Firmware" | >= 7.8.0.0 < 7.8.1.6 Search vendor "Ibm" for product "Storwize V9000 Firmware" and version " >= 7.8.0.0 < 7.8.1.6" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V9000 Search vendor "Ibm" for product "Storwize V9000" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V9000 Firmware Search vendor "Ibm" for product "Storwize V9000 Firmware" | >= 8.1.1.0 < 8.1.1.2 Search vendor "Ibm" for product "Storwize V9000 Firmware" and version " >= 8.1.1.0 < 8.1.1.2" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V9000 Search vendor "Ibm" for product "Storwize V9000" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Storwize V9000 Firmware Search vendor "Ibm" for product "Storwize V9000 Firmware" | >= 8.1.2.0 < 8.1.2.1 Search vendor "Ibm" for product "Storwize V9000 Firmware" and version " >= 8.1.2.0 < 8.1.2.1" | - |
Affected
| in | Ibm Search vendor "Ibm" | Storwize V9000 Search vendor "Ibm" for product "Storwize V9000" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | San Volume Controller Firmware Search vendor "Ibm" for product "San Volume Controller Firmware" | >= 6.1.0.0 < 7.5.0.14 Search vendor "Ibm" for product "San Volume Controller Firmware" and version " >= 6.1.0.0 < 7.5.0.14" | - |
Affected
| in | Ibm Search vendor "Ibm" | San Volume Controller Search vendor "Ibm" for product "San Volume Controller" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | San Volume Controller Firmware Search vendor "Ibm" for product "San Volume Controller Firmware" | >= 7.7.0.0 < 7.7.1.9 Search vendor "Ibm" for product "San Volume Controller Firmware" and version " >= 7.7.0.0 < 7.7.1.9" | - |
Affected
| in | Ibm Search vendor "Ibm" | San Volume Controller Search vendor "Ibm" for product "San Volume Controller" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | San Volume Controller Firmware Search vendor "Ibm" for product "San Volume Controller Firmware" | >= 7.8.0.0 < 7.8.1.6 Search vendor "Ibm" for product "San Volume Controller Firmware" and version " >= 7.8.0.0 < 7.8.1.6" | - |
Affected
| in | Ibm Search vendor "Ibm" | San Volume Controller Search vendor "Ibm" for product "San Volume Controller" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | San Volume Controller Firmware Search vendor "Ibm" for product "San Volume Controller Firmware" | >= 8.1.1.0 < 8.1.1.2 Search vendor "Ibm" for product "San Volume Controller Firmware" and version " >= 8.1.1.0 < 8.1.1.2" | - |
Affected
| in | Ibm Search vendor "Ibm" | San Volume Controller Search vendor "Ibm" for product "San Volume Controller" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | San Volume Controller Firmware Search vendor "Ibm" for product "San Volume Controller Firmware" | >= 8.1.2.0 < 8.1.2.1 Search vendor "Ibm" for product "San Volume Controller Firmware" and version " >= 8.1.2.0 < 8.1.2.1" | - |
Affected
| in | Ibm Search vendor "Ibm" | San Volume Controller Search vendor "Ibm" for product "San Volume Controller" | - | - |
Safe
|
| Ibm Search vendor "Ibm" | Spectrum Virtualize Search vendor "Ibm" for product "Spectrum Virtualize" | >= 6.1.0.0 < 7.5.0.14 Search vendor "Ibm" for product "Spectrum Virtualize" and version " >= 6.1.0.0 < 7.5.0.14" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Spectrum Virtualize Search vendor "Ibm" for product "Spectrum Virtualize" | >= 7.7.0.0 < 7.7.1.9 Search vendor "Ibm" for product "Spectrum Virtualize" and version " >= 7.7.0.0 < 7.7.1.9" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Spectrum Virtualize Search vendor "Ibm" for product "Spectrum Virtualize" | >= 7.8.0.0 < 7.8.1.6 Search vendor "Ibm" for product "Spectrum Virtualize" and version " >= 7.8.0.0 < 7.8.1.6" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Spectrum Virtualize Search vendor "Ibm" for product "Spectrum Virtualize" | >= 8.1.1.0 < 8.1.1.2 Search vendor "Ibm" for product "Spectrum Virtualize" and version " >= 8.1.1.0 < 8.1.1.2" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Spectrum Virtualize Search vendor "Ibm" for product "Spectrum Virtualize" | >= 8.1.2.0 < 8.1.2.1 Search vendor "Ibm" for product "Spectrum Virtualize" and version " >= 8.1.2.0 < 8.1.2.1" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Spectrum Virtualize For Public Cloud Search vendor "Ibm" for product "Spectrum Virtualize For Public Cloud" | >= 6.1.0.0 < 7.5.0.14 Search vendor "Ibm" for product "Spectrum Virtualize For Public Cloud" and version " >= 6.1.0.0 < 7.5.0.14" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Spectrum Virtualize For Public Cloud Search vendor "Ibm" for product "Spectrum Virtualize For Public Cloud" | >= 7.7.0.0 < 7.7.1.9 Search vendor "Ibm" for product "Spectrum Virtualize For Public Cloud" and version " >= 7.7.0.0 < 7.7.1.9" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Spectrum Virtualize For Public Cloud Search vendor "Ibm" for product "Spectrum Virtualize For Public Cloud" | >= 7.8.0.0 < 7.8.1.6 Search vendor "Ibm" for product "Spectrum Virtualize For Public Cloud" and version " >= 7.8.0.0 < 7.8.1.6" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Spectrum Virtualize For Public Cloud Search vendor "Ibm" for product "Spectrum Virtualize For Public Cloud" | >= 8.1.1.0 < 8.1.1.2 Search vendor "Ibm" for product "Spectrum Virtualize For Public Cloud" and version " >= 8.1.1.0 < 8.1.1.2" | - |
Affected
| ||||||
| Ibm Search vendor "Ibm" | Spectrum Virtualize For Public Cloud Search vendor "Ibm" for product "Spectrum Virtualize For Public Cloud" | >= 8.1.2.0 < 8.1.2.1 Search vendor "Ibm" for product "Spectrum Virtualize For Public Cloud" and version " >= 8.1.2.0 < 8.1.2.1" | - |
Affected
| ||||||