PT-2023-31402 · Ibm · Ibm System Storage Virtualization Engine Ts7700

Published 2023-12-13 · Updated 2023-12-19 · CVE-2023-49877

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM System Storage Virtualization Engine TS7700 versions 3957-VEC, 3948-VED

Description The issue allows a remote authenticated user to obtain sensitive information due to improper filtering of URLs. By submitting a specially crafted HTTP GET request, an attacker could exploit this to view application source code, system configuration information, or other sensitive data related to the Management Interface.

Recommendations For versions 3957-VEC and 3948-VED, consider restricting access to the Management Interface until a patch is available. As a temporary workaround, avoid using the vulnerable URL filtering mechanism in the Management Interface. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-49877

Affected Products

Ibm System Storage Virtualization Engine Ts7700

References · 7

• https://osv.dev/vulnerability/CVE-2023-49877 · Vendor Advisory
• https://ibm.com/support/pages/node/7092383 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/272651 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-49877 · Security Note
• https://twitter.com/CVEnew/status/1735039999790219636 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1735085829746311614 · Twitter Post
• https://t.me/cvenotify/64069 · Telegram Post