PT-2024-13475 · Ibm · Ibm Storage Virtualize+3

Published 2024-02-07 · Updated 2024-02-15 · CVE-2023-47700

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM SAN Volume Controller version 8.6 IBM Storwize version 8.6 IBM FlashSystem version 8.6 IBM Storage Virtualize version 8.6

Description The issue allows a remote attacker to spoof a trusted system that would not be correctly validated by the Storwize server. This could lead to a user connecting to a malicious host, believing that it was a trusted system and deceived into accepting spoofed data.

Recommendations For IBM SAN Volume Controller version 8.6, consider restricting access to the Storwize server until a patch is available. For IBM Storwize version 8.6, consider disabling the validation mechanism temporarily to minimize the risk of exploitation. For IBM FlashSystem version 8.6, restrict access to the system to prevent potential spoofing attacks. For IBM Storage Virtualize version 8.6, avoid using the system for trusted connections until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2023-47700

Affected Products

Ibm Flashsystem

Ibm San Volume Controller

Ibm Storage Virtualize

Ibm Storwize

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2023-47700 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/271016 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-47700 · Vendor Advisory
• https://ibm.com/support/pages/node/7114767 · Vendor Advisory
• https://twitter.com/CVEnew/status/1755270384218444276 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1755315709423341921 · Twitter Post
• https://t.me/cvenotify/71563 · Telegram Post