CVE-2018-1433 IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) web han...
HighCVSS 7.5
EPSS 2.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) web handler /DownloadFile does not require authentication to read arbitrary files from the system. IBM X-Force ID: 139473.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm storwize v7000 firmware | >= 6.1.0.0, < 7.5.0.14 | 7.5.0.14 |
| ibm storwize v7000 firmware | >= 7.7.0.0, < 7.7.1.9 | 7.7.1.9 |
| ibm storwize v7000 firmware | >= 7.8.0.0, < 7.8.1.6 | 7.8.1.6 |
| ibm storwize v7000 firmware | >= 8.1.1.0, < 8.1.1.2 | 8.1.1.2 |
| ibm storwize v7000 firmware | >= 8.1.2.0, < 8.1.2.1 | 8.1.2.1 |
| ibm storwize v5000 firmware | >= 6.1.0.0, < 7.5.0.14 | 7.5.0.14 |
| ibm storwize v5000 firmware | >= 7.7.0.0, < 7.7.1.9 | 7.7.1.9 |
| ibm storwize v5000 firmware | >= 7.8.0.0, < 7.8.1.6 | 7.8.1.6 |
| ibm storwize v5000 firmware | >= 8.1.1.0, < 8.1.1.2 | 8.1.1.2 |
| ibm storwize v5000 firmware | >= 8.1.2.0, < 8.1.2.1 | 8.1.2.1 |
| ibm storwize v3700 firmware | >= 6.1.0.0, < 7.5.0.14 | 7.5.0.14 |
| ibm storwize v3700 firmware | >= 7.7.0.0, < 7.7.1.9 | 7.7.1.9 |
| ibm storwize v3700 firmware | >= 7.8.0.0, < 7.8.1.6 | 7.8.1.6 |
| ibm storwize v3700 firmware | >= 8.1.1.0, < 8.1.1.2 | 8.1.1.2 |
| ibm storwize v3700 firmware | >= 8.1.2.0, < 8.1.2.1 | 8.1.2.1 |
| ibm storwize v3500 firmware | >= 6.1.0.0, < 7.5.0.14 | 7.5.0.14 |
| ibm storwize v3500 firmware | >= 7.7.0.0, < 7.7.1.9 | 7.7.1.9 |
| ibm storwize v3500 firmware | >= 7.8.0.0, < 7.8.1.6 | 7.8.1.6 |
| ibm storwize v3500 firmware | >= 8.1.1.0, < 8.1.1.2 | 8.1.1.2 |
| ibm storwize v3500 firmware | >= 8.1.2.0, < 8.1.2.1 | 8.1.2.1 |
| ibm storwize v9000 firmware | >= 6.1.0.0, < 7.5.0.14 | 7.5.0.14 |
| ibm storwize v9000 firmware | >= 7.7.0.0, < 7.7.1.9 | 7.7.1.9 |
| ibm storwize v9000 firmware | >= 7.8.0.0, < 7.8.1.6 | 7.8.1.6 |
| ibm storwize v9000 firmware | >= 8.1.1.0, < 8.1.1.2 | 8.1.1.2 |
| ibm storwize v9000 firmware | >= 8.1.2.0, < 8.1.2.1 | 8.1.2.1 |
Show 15 more
| Product | Affected versions | Fixed in |
|---|---|---|
| ibm san volume controller firmware | >= 6.1.0.0, < 7.5.0.14 | 7.5.0.14 |
| ibm san volume controller firmware | >= 7.7.0.0, < 7.7.1.9 | 7.7.1.9 |
| ibm san volume controller firmware | >= 7.8.0.0, < 7.8.1.6 | 7.8.1.6 |
| ibm san volume controller firmware | >= 8.1.1.0, < 8.1.1.2 | 8.1.1.2 |
| ibm san volume controller firmware | >= 8.1.2.0, < 8.1.2.1 | 8.1.2.1 |
| ibm spectrum virtualize | >= 6.1.0.0, < 7.5.0.14 | 7.5.0.14 |
| ibm spectrum virtualize | >= 7.7.0.0, < 7.7.1.9 | 7.7.1.9 |
| ibm spectrum virtualize | >= 7.8.0.0, < 7.8.1.6 | 7.8.1.6 |
| ibm spectrum virtualize | >= 8.1.1.0, < 8.1.1.2 | 8.1.1.2 |
| ibm spectrum virtualize | >= 8.1.2.0, < 8.1.2.1 | 8.1.2.1 |
| ibm spectrum virtualize for public cloud | >= 6.1.0.0, < 7.5.0.14 | 7.5.0.14 |
| ibm spectrum virtualize for public cloud | >= 7.7.0.0, < 7.7.1.9 | 7.7.1.9 |
| ibm spectrum virtualize for public cloud | >= 7.8.0.0, < 7.8.1.6 | 7.8.1.6 |
| ibm spectrum virtualize for public cloud | >= 8.1.1.0, < 8.1.1.2 | 8.1.1.2 |
| ibm spectrum virtualize for public cloud | >= 8.1.2.0, < 8.1.2.1 | 8.1.2.1 |
References
- www.ibm.com vendor-advisory
- www.ibm.com vendor-advisory
- www.ibm.com vendor-advisory
- 104349 third-party-advisory vdb-entry
- ibm-storwize-cve20181433-file-download(139473) vdb-entry vendor-advisory