CVE-2018-1438

published 2018-05-17

CVE-2018-1438: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7…

Priority P3 47 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) web handler /DLSnap could allow an unauthenticated attacker to read arbitrary files on the system. IBM X-Force ID: 139566.

Affected

40 ranges · showing 25

Vendor	Product	Version range	Fixed in
ibm	san_volume_controller_firmware	>= 6.1.0.0 < 7.5.0.14	7.5.0.14
ibm	san_volume_controller_firmware	>= 7.7.0.0 < 7.7.1.9	7.7.1.9
ibm	san_volume_controller_firmware	>= 7.8.0.0 < 7.8.1.6	7.8.1.6
ibm	san_volume_controller_firmware	>= 8.1.1.0 < 8.1.1.2	8.1.1.2
ibm	san_volume_controller_firmware	>= 8.1.2.0 < 8.1.2.1	8.1.2.1
ibm	spectrum_virtualize	>= 6.1.0.0 < 7.5.0.14	7.5.0.14
ibm	spectrum_virtualize	>= 7.7.0.0 < 7.7.1.9	7.7.1.9
ibm	spectrum_virtualize	>= 7.8.0.0 < 7.8.1.6	7.8.1.6
ibm	spectrum_virtualize	>= 8.1.1.0 < 8.1.1.2	8.1.1.2
ibm	spectrum_virtualize	>= 8.1.2.0 < 8.1.2.1	8.1.2.1
ibm	spectrum_virtualize_for_public_cloud	>= 6.1.0.0 < 7.5.0.14	7.5.0.14
ibm	spectrum_virtualize_for_public_cloud	>= 7.7.0.0 < 7.7.1.9	7.7.1.9
ibm	spectrum_virtualize_for_public_cloud	>= 7.8.0.0 < 7.8.1.6	7.8.1.6
ibm	spectrum_virtualize_for_public_cloud	>= 8.1.1.0 < 8.1.1.2	8.1.1.2
ibm	spectrum_virtualize_for_public_cloud	>= 8.1.2.0 < 8.1.2.1	8.1.2.1
ibm	storwize_v3500_firmware	>= 6.1.0.0 < 7.5.0.14	7.5.0.14
ibm	storwize_v3500_firmware	>= 7.7.0.0 < 7.7.1.9	7.7.1.9
ibm	storwize_v3500_firmware	>= 7.8.0.0 < 7.8.1.6	7.8.1.6
ibm	storwize_v3500_firmware	>= 8.1.1.0 < 8.1.1.2	8.1.1.2
ibm	storwize_v3500_firmware	>= 8.1.2.0 < 8.1.2.1	8.1.2.1
ibm	storwize_v3700_firmware	>= 6.1.0.0 < 7.5.0.14	7.5.0.14
ibm	storwize_v3700_firmware	>= 7.7.0.0 < 7.7.1.9	7.7.1.9
ibm	storwize_v3700_firmware	>= 7.8.0.0 < 7.8.1.6	7.8.1.6
ibm	storwize_v3700_firmware	>= 8.1.1.0 < 8.1.1.2	8.1.1.2
ibm	storwize_v3700_firmware	>= 8.1.2.0 < 8.1.2.1	8.1.2.1

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200