IBM Spectrum Scale vulnerabilities

57 CVEs affecting IBM Spectrum Scale, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-43843, published 2023-12-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-4241, published 2020-03-31. High severity, CVSS 8.8. EPSS: 66.3% chance of exploitation in the next 30 days. IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request,…
CVE-2020-4242, published 2020-03-31. High severity, CVSS 8.8. EPSS: 4.6% chance of exploitation in the next 30 days. IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request,…
CVE-2019-4715, published 2019-12-11. High severity, CVSS 8.8. EPSS: 4% chance of exploitation in the next 30 days. IBM Spectrum Scale 4.2 and 5.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this…
CVE-2016-6115, published 2017-02-01. High severity, CVSS 7.2. EPSS: 4% chance of exploitation in the next 30 days. IBM General Parallel File System is vulnerable to a buffer overflow. A remote authenticated attacker could overflow a buffer and execute arbitrary code on the system with root privileges or cause the…
CVE-2020-4217, published 2020-03-09. High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days. The IBM Spectrum Scale 4.2 and 5.0 file system component is affected by a denial of service security vulnerability. An attacker can force the Spectrum Scale mmfsd/mmsdrserv daemons to unexpectedly…
CVE-2020-4412, published 2020-05-19. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. The Spectrum Scale 4.2.0.0 through 4.2.3.21 and 5.0.0.0 through 5.0.4.3 file system component is affected by a denial of service security vulnerability. An attacker can force the Spectrum Scale…
CVE-2021-29667, published 2021-04-27. High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days. IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper…
CVE-2019-4558, published 2019-10-09. High severity, CVSS 7.8. EPSS: 1.2% chance of exploitation in the next 30 days. A security vulnerability has been identified in all levels of IBM Spectrum Scale V5.0.0.0 through V5.0.3.2 and IBM Spectrum Scale V4.2.0.0 through V4.2.3.17 that could allow a local attacker to…
CVE-2015-7456, published 2016-01-01. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. IBM Spectrum Scale 4.1.1 before 4.1.1.4, and 4.2.0.0, allows remote authenticated users to discover object-storage admin passwords via unspecified vectors.
CVE-2020-4749, published 2020-10-20. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. IBM Spectrum Scale 5.0.0 through 5.0.5.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a…

Latest

CVE-2022-43843, published 2023-12-14. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Spectrum Scale 5.1.5.0 through 5.1.5.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 239080.
CVE-2023-30434, published 2023-05-05. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Storage Scale (IBM Spectrum Scale 5.1.0.0 through 5.1.2.9, 5.1.3.0 through 5.1.6.1 and IBM Elastic Storage Systems 6.1.0.0 through 6.1.2.5, 6.1.3.0 through 6.1.6.0) could allow a local user to…
CVE-2020-4927, published 2023-03-15. High severity, CVSS 8.2. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability in the Spectrum Scale 5.0.5.0 through 5.1.6.1 core component could allow unauthorized access to user data or injection of arbitrary data in the communication protocol. IBM X-Force…
CVE-2022-43869, published 2023-02-12. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. IBM Spectrum Scale (5.1.0.0 through 5.1.2.8 and 5.1.3.0 through 5.1.5.1) and IBM Elastic Storage System (6.1.0.0 through 6.1.2.4 and 6.1.3.0 through 6.1.4.1) could allow an authenticated user to…
CVE-2022-40607, published 2022-12-19. Medium severity, CVSS 6.8. EPSS: 0.9% chance of exploitation in the next 30 days. IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and directories outside of the volume, including on the host…
CVE-2020-4926, published 2022-05-24. Critical severity, CVSS 9.1. EPSS: 0.7% chance of exploitation in the next 30 days. A vulnerability in the Spectrum Scale 5.1 core component and IBM Elastic Storage System 6.1 could allow unauthorized access to user data or injection of arbitrary data in the communication protocol.…
CVE-2022-22368, published 2022-05-03. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Spectrum Scale 5.1.0 through 5.1.3.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 221012.
CVE-2020-4925, published 2022-03-01. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. A security vulnerability in the Spectrum Scale 5.0 and 5.1 allows a non-root user to overflow the mmfsd daemon with requests and preventing the daemon to service other requests. IBM X-Force ID:…
CVE-2021-38882, published 2021-11-16. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. IBM Spectrum Scale 5.1.0 through 5.1.1.1 could allow a privileged admin to destroy filesystem audit logging records before expiration time. IBM X-Force ID: 209164.
CVE-2021-29740, published 2021-06-01. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.3 system core component is affected by a format string security vulnerability. An attacker could execute arbitrary code in the context…