CVE-2018-1822 — Improper Authentication in IBM Flashsystem 840 Firmware

CWE-287 — Improper Authentication3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
0.4%
top 42.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Flashsystem 840 FirmwareIBM Flashsystem 900 Firmware
Timeline
PublishedOct 18
Latest updateMay 13

Description

IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages2 packages

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-gf4v-v7xg-cvwx: IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to↗2022-05-13
▶
CVEList
CVE-2018-1822: IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to↗2018-10-18
▶
CVE-2018-1822 — Improper Authentication in IBM | cvebase