Details of VAR-201810-0672

ID

VAR-201810-0672

CVE

CVE-2018-1822

TITLE

IBM FlashSystem 900 Authentication vulnerabilities in products

Trust: 0.8

sources: JVNDB: JVNDB-2018-012594

DESCRIPTION

IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296. IBM FlashSystem 900 The product contains authentication vulnerabilities. Vendors have confirmed this vulnerability IBM X-Force ID: 150296 It is released as.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. are all enterprise-level storage solutions of IBM Corporation in the United States. The solution provides a full set of disaster recovery tools (including snapshot, clone and replication) to protect data security and use IBM Virtual Storage Center to realize virtualization configuration and performance management. GUI is one of the Graphical User Interfaces. The following products are affected: IBM FlashSystem 840 MTMs 9840-AE1; FlashSystem 840 MTMs 9843-AE1; FlashSystem 900 MTMs 9840-AE2; FlashSystem 900 MTMs 9840-AE29843-AE2

Trust: 1.8

sources: NVD: CVE-2018-1822 // JVNDB: JVNDB-2018-012594 // VULHUB: VHN-128757 // VULMON: CVE-2018-1822

AFFECTED PRODUCTS

vendor:	ibm	model:	flashsystem 900	scope:	eq	version:	1.4	Trust: 1.6
vendor:	ibm	model:	flashsystem 840	scope:	eq	version:	1.4	Trust: 1.6
vendor:	ibm	model:	flashsystem v840	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	flashsystem v900	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2018-012594 // CNNVD: CNNVD-201810-1036 // NVD: CVE-2018-1822

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-1822
value:	CRITICAL
Trust: 1.0
psirt@us.ibm.com:	CVE-2018-1822
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2018-1822
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201810-1036
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-128757
value:	HIGH
Trust: 0.1
VULMON:	CVE-2018-1822
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2018-1822
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.9
VULHUB:	VHN-128757
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-1822
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.0
Trust: 2.8

sources: VULHUB: VHN-128757 // VULMON: CVE-2018-1822 // JVNDB: JVNDB-2018-012594 // CNNVD: CNNVD-201810-1036 // NVD: CVE-2018-1822 // NVD: CVE-2018-1822

PROBLEMTYPE DATA

problemtype:

CWE-287

Trust: 1.9

sources: VULHUB: VHN-128757 // JVNDB: JVNDB-2018-012594 // NVD: CVE-2018-1822

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201810-1036

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201810-1036

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-012594

PATCH

title:	0732962	url:	https://www-01.ibm.com/support/docview.wss?uid=ibm10732962	Trust: 0.8
title:	ibm-flashsystem-cve20181822-sec-bypass (150296)	url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/150296	Trust: 0.8
title:	Multiple IBM product GUI Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=86194	Trust: 0.6

sources: JVNDB: JVNDB-2018-012594 // CNNVD: CNNVD-201810-1036

EXTERNAL IDS

db:	NVD	id:	CVE-2018-1822	Trust: 2.6
db:	JVNDB	id:	JVNDB-2018-012594	Trust: 0.8
db:	CNNVD	id:	CNNVD-201810-1036	Trust: 0.7
db:	VULHUB	id:	VHN-128757	Trust: 0.1
db:	VULMON	id:	CVE-2018-1822	Trust: 0.1

sources: VULHUB: VHN-128757 // VULMON: CVE-2018-1822 // JVNDB: JVNDB-2018-012594 // CNNVD: CNNVD-201810-1036 // NVD: CVE-2018-1822

REFERENCES

url:	http://www.ibm.com/support/docview.wss?uid=ibm10732962	Trust: 1.8
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/150296	Trust: 1.8
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-1822	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-1822	Trust: 0.8
url:	https://cwe.mitre.org/data/definitions/287.html	Trust: 0.1
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-128757 // VULMON: CVE-2018-1822 // JVNDB: JVNDB-2018-012594 // CNNVD: CNNVD-201810-1036 // NVD: CVE-2018-1822

SOURCES

db:	VULHUB	id:	VHN-128757
db:	VULMON	id:	CVE-2018-1822
db:	JVNDB	id:	JVNDB-2018-012594
db:	CNNVD	id:	CNNVD-201810-1036
db:	NVD	id:	CVE-2018-1822

LAST UPDATE DATE

2024-08-14T15:28:47.722000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-128757	date:	2019-10-09T00:00:00
db:	VULMON	id:	CVE-2018-1822	date:	2019-10-09T00:00:00
db:	JVNDB	id:	JVNDB-2018-012594	date:	2019-02-05T00:00:00
db:	CNNVD	id:	CNNVD-201810-1036	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-1822	date:	2019-10-09T23:39:10.087

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-128757	date:	2018-10-18T00:00:00
db:	VULMON	id:	CVE-2018-1822	date:	2018-10-18T00:00:00
db:	JVNDB	id:	JVNDB-2018-012594	date:	2019-02-05T00:00:00
db:	CNNVD	id:	CNNVD-201810-1036	date:	2018-10-19T00:00:00
db:	NVD	id:	CVE-2018-1822	date:	2018-10-18T15:29:00.573