Medium severity · published Feb 27, 2019
CVE-2018-1775
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to download arbitrary…
6.5
CVSS
1.9%
EPSS
No
On KEV
Description
IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to download arbitrary files from the operating system. IBM X-Force ID: 148757.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
F9
FlashSystem 9100 Family · IBM
7.5; 8.2 · source: vendor
FV
FlashSystem V9000 · IBM
7.5; 8.2 · source: vendor
SV
SAN Volume Controller · IBM
7.5; 8.2 · source: vendor
SV
Spectrum Virtualize Software · IBM
7.5; 8.2 · source: vendor, NVD
SV
Spectrum Virtualize for Public Cloud · IBM
7.5; 8.2 · source: vendor
TV
torwize V3500 · IBM
7.5; 8.2 · source: vendor
TV
torwize V3700 · IBM
7.5; 8.2 · source: vendor
TV
torwize V5000 · IBM
7.5; 8.2 · source: vendor
TV
torwize V7000 · IBM
7.5; 8.2 · source: vendor
SV
Spectrum Virtualize Software For Public Cloud · Ibm
7.5 through 8.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1775
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1775
Third Party Advisory
http://www.securityfocus.com/bid/107187
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/148757
Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10872486