NetSight
IP …
medium5.4

CVE-2018-1461

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7…

Impact

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 140362.

Affected products

VendorProductAffected versions
IbmStorwize V7000 Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmStorwize V5000 Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmStorwize V3700 Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmStorwize V3500 Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmStorwize V9000 Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmSan Volume Controller Firmware
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmSpectrum Virtualize
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1
IbmSpectrum Virtualize For Public Cloud
from 6.1.0.0 before 7.5.0.14
from 7.7.0.0 before 7.7.1.9
from 7.8.0.0 before 7.8.1.6
from 8.1.1.0 before 8.1.1.2
from 8.1.2.0 before 8.1.2.1

Weakness classification

CWE-79

References