PT-2019-9519 · Ibm · Ibm San Volume Controller+3

Published 2019-02-27 · Updated 2019-10-09 · CVE-2018-1775

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2

Description The issue allows an authenticated user to download arbitrary files from the operating system.

Recommendations For versions 7.5 through 8.2, update to a version that contains a fix for this issue to prevent authenticated users from downloading arbitrary files.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-1775

Affected Products

Ibm Flashsystem

Ibm San Volume Controller

Ibm Spectrum Virtualize

Ibm Storwize

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-1775 · Security Note
• https://ibm.com/support/docview.wss?uid=ibm10872486 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1775 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/148757 · Vendor Advisory
• http://securityfocus.com/bid/107187 · Note