CVE-2024-38320 — Use of a Broken or Risky Cryptographic Algorithm in IBM Storage Protect

CWE-327 — Use of a Broken or Risky Cryptographic Algorithm3 documents3 sources
Severity
7.5HIGHNVD
CNA5.9
EPSS
0.1%
top 75.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
IBM Storage ProtectIBM Storage Protect FOR Virtual EnvironmentsIBM Storage Protect Backup-archive Client+1 more
Timeline
PublishedJan 27

Description

IBM Storage Protect for Virtual Environments: Data Protection for VMware and Storage Protect Backup-Archive Client 8.1.0.0 through 8.1.23.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5ibm/storage_protect_backup-archive_client8.1.0.0 — 8.1.23.0
▶NVDibm/storage_protect8.1.0.0 — 8.1.24.0

🔴Vulnerability Details

2
CVEList
IBM Storage Protect for Virtual Environments: Data Protection for VMware information disclosure↗2025-01-27
▶
GHSA
GHSA-2mvp-p4pm-xcpx: IBM Storage Protect for Virtual Environments: Data Protection for VMware and Storage Protect Backup-Archive Client 8↗2025-01-27
▶
CVE-2024-38320 — IBM Storage Protect vulnerability | cvebase