PT-2024-21787 · Ibm · Ibm Storage Protect Plus Server

Published 2024-03-21 · Updated 2025-02-14 · CVE-2024-27277

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Storage Protect Plus Server versions 10.1.0 through 10.1.16

Description The private key for the IBM Storage Protect Plus Server certificate can be disclosed, undermining the security of the certificate. This issue allows for remote exploitation.

Recommendations For versions 10.1.0 through 10.1.16, upgrade to a version that fixes the private key disclosure issue as soon as possible to prevent remote exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-27277

Affected Products

Ibm Storage Protect Plus Server

References · 10

• https://ibm.com/support/pages/node/7144861 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27277 · Security Note
• https://osv.dev/vulnerability/CVE-2024-27277 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/285205 · Vendor Advisory
• https://twitter.com/CVEnew/status/1770865197668077695 · Twitter Post
• https://t.me/cvenotify/111414 · Telegram Post
• https://twitter.com/RedPacketSec/status/1771116658217631821 · Twitter Post
• https://t.me/cvenotify/74344 · Telegram Post
• https://twitter.com/oktsec/status/1772081418165784921 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1770884247886184875 · Twitter Post