NetSight
IP …
high7.5

CVE-2018-1438

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7…

Impact

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) web handler /DLSnap could allow an unauthenticated attacker to read arbitrary files on the system. IBM X-Force ID: 139566.

Affected products

VendorProductAffected versions
IbmStorwize V7000 Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmStorwize V5000 Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmStorwize V3700 Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmStorwize V3500 Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmStorwize V9000 Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmSan Volume Controller Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmSpectrum Virtualize
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmSpectrum Virtualize For Public Cloud
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1

Weakness classification

CWE-200

References