Multiple IBM Products CVE-2018-1775 Arbitrary File Download Vulnerabilitiy
BID:107187
CVE-2018-1775 |Info
Multiple IBM Products CVE-2018-1775 Arbitrary File Download Vulnerabilitiy
| Bugtraq ID: | 107187 |
| Class: | Design Error |
| CVE: |
CVE-2018-1775 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 25 2019 12:00AM |
| Updated: | Feb 25 2019 12:00AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
IBM Storwize V7000 8.2 IBM Storwize V7000 8.1.0.0 IBM Storwize V7000 8.0 IBM Storwize V7000 7.8 IBM Storwize V7000 7.7 IBM Storwize V7000 7.6 IBM Storwize V7000 7.5 IBM Storwize V5000 8.2 IBM Storwize V5000 8.1.0.0 IBM Storwize V5000 8.0 IBM Storwize V5000 7.8 IBM Storwize V5000 7.7 IBM Storwize V5000 7.6 IBM Storwize V5000 7.5 IBM Storwize V3700 8.2 IBM Storwize V3700 8.0 IBM Storwize V3700 7.8 IBM Storwize V3700 7.7 IBM Storwize V3700 7.6 IBM Storwize V3700 7.5 IBM Storwize V3500 8.2 IBM Storwize V3500 8.0 IBM Storwize V3500 7.8 IBM Storwize V3500 7.6 IBM Storwize V3500 7.5 IBM Spectrum Virtualize Software 8.1 IBM Spectrum Virtualize Software 8.0 IBM Spectrum Virtualize Software 7.8 IBM Spectrum Virtualize Software 7.7 IBM Spectrum Virtualize for Public Cloud 8.1 IBM Spectrum Virtualize for Public Cloud 8.0 IBM Spectrum Virtualize for Public Cloud 7.8 IBM Spectrum Virtualize for Public Cloud 7.7 IBM Spectrum Virtualize for Public Cloud 7.5 IBM SAN Volume Controller 8.2 IBM SAN Volume Controller 8.1.0.0 IBM SAN Volume Controller 8.0 IBM SAN Volume Controller 7.8 IBM SAN Volume Controller 7.7 IBM SAN Volume Controller 7.6 IBM SAN Volume Controller 7.5 IBM FlashSystem V9000 8.2 IBM FlashSystem V9000 8.0 IBM FlashSystem V9000 7.8 IBM FlashSystem V9000 7.7 IBM FlashSystem V9000 7.5 IBM FlashSystem 9100 Family 8.2 IBM FlashSystem 9100 Family 7.5 |
| Not Vulnerable: |
IBM Storwize V7000 8.2.1.0 IBM Storwize V7000 8.2.0.0 IBM Storwize V7000 8.1.3.3 IBM Storwize V7000 7.8.1.8 IBM Storwize V5000 8.2.1.0 IBM Storwize V5000 8.2.0.0 IBM Storwize V5000 7.8.1.8 IBM Storwize V5000 8.1.3.3 IBM Storwize V3700 8.2.1.0 IBM Storwize V3700 7.8.1.8 IBM Storwize V3700 8.2.0.0 IBM Storwize V3700 8.1.3.3 IBM Storwize V3500 8.2.1.0 IBM Storwize V3500 8.2.0.0 IBM Storwize V3500 8.1.3.3 IBM Storwize V3500 7.8.1.8 IBM Spectrum Virtualize Software 8.2.1.0 IBM Spectrum Virtualize Software 7.8.1.8 IBM Spectrum Virtualize Software 8.2.0.0 IBM Spectrum Virtualize Software 8.1.3.3 IBM Spectrum Virtualize for Public Cloud 8.2.1.0 IBM Spectrum Virtualize for Public Cloud 8.2.0.0 IBM Spectrum Virtualize for Public Cloud 8.1.3.3 IBM Spectrum Virtualize for Public Cloud 7.8.1.8 IBM SAN Volume Controller 8.2.1.0 IBM SAN Volume Controller 8.2.0.0 IBM SAN Volume Controller 8.1.3.3 IBM SAN Volume Controller 7.8.1.8 IBM FlashSystem V9000 8.2.1.0 IBM FlashSystem V9000 7.8.1.8 IBM FlashSystem V9000 8.2.0.0 IBM FlashSystem V9000 8.1.3.3 IBM FlashSystem 9100 Family 8.2.1.0 IBM FlashSystem 9100 Family 7.8.1.8 IBM FlashSystem 9100 Family 8.2.0.0 IBM FlashSystem 9100 Family 8.1.3.3 |
Discussion
Multiple IBM Products CVE-2018-1775 Arbitrary File Download Vulnerabilitiy
Multiple IBM products are prone to an arbitrary-file-download vulnerability.
An attacker can exploit this issue to download arbitrary files from the device filesystem and obtain potentially sensitive information.
The following products and versions are affected:
IBM SAN Volume Controller 7.5 through 8.2
IBM Storwize V7000 7.5 through 8.2
IBM Storwize V5000 7.5 through 8.2
IBM Storwize V3700 7.5 through 8.2
IBM Storwize V3500 7.5 through 8.2
IBM FlashSystem V9000 7.5 through 8.2
IBM FlashSystem 9100 Family 7.5 through 8.2
IBM Spectrum Virtualize Software 7.5 through 8.2
IBM Spectrum Virtualize for Public Cloud 7.5 through 8.2
Multiple IBM products are prone to an arbitrary-file-download vulnerability.
An attacker can exploit this issue to download arbitrary files from the device filesystem and obtain potentially sensitive information.
The following products and versions are affected:
IBM SAN Volume Controller 7.5 through 8.2
IBM Storwize V7000 7.5 through 8.2
IBM Storwize V5000 7.5 through 8.2
IBM Storwize V3700 7.5 through 8.2
IBM Storwize V3500 7.5 through 8.2
IBM FlashSystem V9000 7.5 through 8.2
IBM FlashSystem 9100 Family 7.5 through 8.2
IBM Spectrum Virtualize Software 7.5 through 8.2
IBM Spectrum Virtualize for Public Cloud 7.5 through 8.2
Exploit / POC
Multiple IBM Products CVE-2018-1775 Arbitrary File Download Vulnerabilitiy
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Multiple IBM Products CVE-2018-1775 Arbitrary File Download Vulnerabilitiy
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.