CVE-2022-43869 — Use of Externally-Controlled Format String in IBM Elastic Storage System

CWE-134 — Use of Externally-Controlled Format String3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.7%
top 29.05%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Elastic Storage SystemIBM Spectrum Scale
Timeline
PublishedFeb 12

Description

IBM Spectrum Scale (5.1.0.0 through 5.1.2.8 and 5.1.3.0 through 5.1.5.1) and IBM Elastic Storage System (6.1.0.0 through 6.1.2.4 and 6.1.3.0 through 6.1.4.1) could allow an authenticated user to cause a denial of service through the GUI using a format string attack. IBM X-Force ID: 239539.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5ibm/elastic_storage_system6.1.0.0 — 6.1.2.4
▶NVDibm/elastic_storage_system6.1.0.0 — 6.1.2.4+1
▶CVEListV5ibm/spectrum_scale5.1.0.0 — 5.1.2.8+1
▶NVDibm/spectrum_scale5.1.0.0 — 5.1.2.8+1

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-c577-76q8-rjr3: IBM Spectrum Scale (5↗2023-02-12
▶
CVEList
IBM Spectrum Scale denial of service↗2023-02-08
▶
CVE-2022-43869 — IBM vulnerability | cvebase