Medium severity · published Dec 19, 2022
CVE-2022-40607
IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and directories outside of the volume,…
6.8
CVSS
1%
EPSS
No
On KEV
Description
IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and directories outside of the volume, including on the host filesystem. IBM X-Force ID: 235740.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SS
Spectrum Scale · Ibm
through 5.1.4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-40607
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-40607
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/235740
Vendor Advisory
https://www.ibm.com/support/pages/node/6848231
More from Spectrum Scale
9.1
CVE-2020-4926
A vulnerability in the Spectrum Scale 5.1 core component and IBM Elastic Storage System 6.1 could allow unauthorized access to user data or injection of arbitrary data in the…
8.8
CVE-2020-4242
IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system
8.8
CVE-2020-4241
IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system
8.8
CVE-2019-4715
IBM Spectrum Scale 4.2 and 5.0 could allow a remote authenticated attacker to execute arbitrary commands on the system
8.2
CVE-2020-4927
IBM Spectrum Scale information disclosure