PT-2023-6701 · Ibm · Ibm Spectrum Virtualize

Published 2023-03-06 · Updated 2023-05-22 · CVE-2023-27870

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Spectrum Virtualize version 8.5

Description The issue is related to insufficient protection of service data during the download process from Fix Central, which could lead to the disclosure of sensitive credential information under certain circumstances. This can be exploited by a remote attacker to gain unauthorized access to protected information when using the satask downloadsoftware command or the "Obtain the package directly" option.

Recommendations For IBM Spectrum Virtualize version 8.5, as a temporary workaround, consider restricting access to the Fix Central download feature until a patch is available. Avoid using the satask downloadsoftware command or the "Obtain the package directly" option in the affected software until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Side Channel Attack

Weakness Enumeration

CWE-200

CWE-203

Related Identifiers

BDU:2023-07472

CVE-2023-27870

Affected Products

Ibm Spectrum Virtualize

References · 8

• https://osv.dev/vulnerability/CVE-2023-27870 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-27870 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/249518 · Vendor Advisory
• https://ibm.com/support/pages/node/6985697 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07472 · Security Note
• https://vuldb.com/?id.228828 · Note
• https://t.me/cibsecurity/63932 · Telegram Post
• https://t.me/cvenotify/50253 · Telegram Post