Vulnerability CVE-2013-0500


Published: 2013-10-16   Modified: 2013-10-17

Description:
IBM Storwize V7000 Unified 1.3.x and 1.4.x before 1.4.2.0 does not properly handle device files that are created with the NFS protocol but accessed with a non-NFS protocol, which allows remote authenticated users to obtain sensitive information, modify programs or files, or cause a denial of service (device crash) via a (1) CIFS, (2) HTTPS, (3) SCP, or (4) SFTP operation.

Type:

CWE-20

(Improper Input Validation)

CVSS2 => (AV:N/AC:M/Au:M/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5.4/10
6.4/10
5.5/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Multiple time
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial
Affected software
IBM -> Storwize v7000 unified software 
IBM -> Storwize v7000 unified 

 References:
http://xforce.iss.net/xforce/xfdb/84839
http://www.ibm.com/support/docview.wss?uid=ssg1S1004430

Copyright 2024, cxsecurity.com

 

Back to Top