NetSight
IP …
high8.8

CVE-2018-1434

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7…

Impact

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 139474.

Affected products

VendorProductAffected versions
IbmStorwize V7000 Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmStorwize V5000 Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmStorwize V3700 Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmStorwize V3500 Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmStorwize V9000 Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmSan Volume Controller Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmSpectrum Virtualize
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmSpectrum Virtualize For Public Cloud
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1

Weakness classification

CWE-352

References