IBM Spectrum Virtualize vulnerabilities

17 CVEs affecting IBM Spectrum Virtualize, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-25681, published 2024-03-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-1433, published 2018-05-17. High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days. IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) web…
CVE-2018-1438, published 2018-05-17. High severity, CVSS 7.5. EPSS: 2.2% chance of exploitation in the next 30 days. IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) web…
CVE-2018-1464, published 2018-05-17. Medium severity, CVSS 6.5. EPSS: 1.6% chance of exploitation in the next 30 days. IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could…
CVE-2020-4686, published 2020-08-17. High severity, CVSS 8.1. EPSS: 1.6% chance of exploitation in the next 30 days. IBM Spectrum Virtualize 8.3.1 could allow a remote user authenticated via LDAP to escalate their privileges and perform actions they should not have access to. IBM X-Force ID: 186678.
CVE-2021-29873, published 2021-10-21. High severity, CVSS 8.1. EPSS: 1.5% chance of exploitation in the next 30 days. IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted shell escape vulnerability. IBM X-Force ID: 206229.
CVE-2018-1463, published 2018-05-17. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could…
CVE-2018-1465, published 2018-05-17. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could…
CVE-2018-1462, published 2018-05-17. High severity, CVSS 7.6. EPSS: 1.2% chance of exploitation in the next 30 days. IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could…
CVE-2018-1461, published 2018-05-17. Medium severity, CVSS 5.4. EPSS: 1% chance of exploitation in the next 30 days. IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are…
CVE-2018-1434, published 2018-05-17. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are…

Latest

CVE-2023-25681, published 2024-03-05. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. LDAP users on IBM Spectrum Virtualize 8.5 which are configured to require multifactor authentication can still authenticate to the CIM interface using only username and password. This does not affect…
CVE-2023-27870, published 2023-05-11. Medium severity, CVSS 5.9. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Spectrum Virtualize 8.5, under certain circumstances, could disclose sensitive credential information while a download from Fix Central is in progress. IBM X-Force ID: 249518.
CVE-2022-43873, published 2023-02-22. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. An authenticated user can exploit a vulnerability in the IBM Spectrum Virtualize 8.2, 8.3, 8.4, and 8.5 GUI to execute code and escalate their privilege on the system. IBM X-Force ID: 239847.
CVE-2022-43870, published 2023-02-22. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Spectrum Virtualize 8.3, 8.4, and 8.5 could disclose SNMPv3 server credentials to an authenticated user in log files. IBM X-Force ID: 239540.
CVE-2022-39167, published 2023-01-19. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. IBM Spectrum Virtualize 8.5, 8.4, 8.3, 8.2, and 7.8, under certain configurations, could disclose sensitive information to an attacker using man-in-the-middle techniques. IBM X-Force ID: 235408.
CVE-2021-38969, published 2022-05-11. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Spectrum Virtualize 8.2, 8.3, and 8.4 could allow an attacker to allow unauthorized access due to the reuse of support generated credentials. IBM X-Force ID: 212609.
CVE-2018-1466, published 2018-05-17. Medium severity, CVSS 5.3. EPSS: 0.8% chance of exploitation in the next 30 days. IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products (6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) use…