IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) web handler /DownloadFile does not require authentication to read arbitrary files from the system. IBM X-Force ID: 139473.

Project Subscriptions

Vendors Products
San Volume Controller Subscribe
San Volume Controller Firmware Subscribe
Spectrum Virtualize Subscribe
Spectrum Virtualize For Public Cloud Subscribe
Storwize V3500 Subscribe
Storwize V3500 Firmware Subscribe
Storwize V3700 Subscribe
Storwize V3700 Firmware Subscribe
Storwize V5000 Subscribe
Storwize V5000 Firmware Subscribe
Storwize V7000 Subscribe
Storwize V7000 Firmware Subscribe
Storwize V9000 Subscribe
Storwize V9000 Firmware Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2018-12012 IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) web handler /DownloadFile does not require authentication to read arbitrary files from the system. IBM X-Force ID: 139473.
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2024-08-05T03:59:39.074Z

Reserved: 2017-12-13T00:00:00

Link: CVE-2018-1433

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-05-17T21:29:00.243

Modified: 2024-11-21T03:59:48.683

Link: CVE-2018-1433

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses