PT-2024-27945 · Ibm · Ibm Storage Protect For Virtual Environments

Published 2024-06-18 · Updated 2024-08-03 · CVE-2024-38329

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM Storage Protect for Virtual Environments: Data Protection for VMware versions 8.1.0.0 through 8.1.22.0

Description The issue is caused by improper validation of user permission, allowing a remote authenticated attacker to bypass security restrictions. By sending a specially crafted request, an attacker could exploit this to change settings, trigger backups, restore backups, and delete all previous backups via log rotation.

Recommendations For versions 8.1.0.0 through 8.1.22.0, consider restricting access to the vulnerable functionality until a patch is available. As a temporary workaround, avoid using the affected settings and backup features to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BDU:2025-06851

CVE-2024-38329

Affected Products

Ibm Storage Protect For Virtual Environments

References · 8

• https://osv.dev/vulnerability/CVE-2024-38329 · Vendor Advisory
• https://ibm.com/support/pages/node/7157929 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06851 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/294994 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38329 · Security Note
• https://twitter.com/cracbot/status/1804756371650564518 · Twitter Post
• https://t.me/cvenotify/88336 · Telegram Post
• https://t.me/cvenotify/88765 · Telegram Post