Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-1465: IBM storage systems risk private key exposure via GUI

CVE-2018-1465 · published 8 years ago

Summary

Certain versions of IBM SAN Volume Controller, Storwize, Spectrum Virtualize and FlashSystem firmware could let a signed-in user retrieve the system's private key, which might allow someone to eavesdrop on the web interface. This could let attackers see data entered through the GUI. Update the firmware to the latest release and limit GUI access to trusted administrators only.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
ibm	storwize_v7000_firmware	>= 6.1.0.0, < 7.5.0.14 >= 7.7.0.0, < 7.7.1.9 >= 7.8.0.0, < 7.8.1.6 >= 8.1.1.0, < 8.1.1.2 >= 8.1.2.0, < 8.1.2.1 `cpe:2.3:o:ibm:storwize_v7000_firmware::::::::`
ibm	storwize_v5000_firmware	>= 6.1.0.0, < 7.5.0.14 >= 7.7.0.0, < 7.7.1.9 >= 7.8.0.0, < 7.8.1.6 >= 8.1.1.0, < 8.1.1.2 >= 8.1.2.0, < 8.1.2.1 `cpe:2.3:o:ibm:storwize_v5000_firmware::::::::`
ibm	storwize_v3700_firmware	>= 6.1.0.0, < 7.5.0.14 >= 7.7.0.0, < 7.7.1.9 >= 7.8.0.0, < 7.8.1.6 >= 8.1.1.0, < 8.1.1.2 >= 8.1.2.0, < 8.1.2.1 `cpe:2.3:o:ibm:storwize_v3700_firmware::::::::`
ibm	storwize_v3500_firmware	>= 6.1.0.0, < 7.5.0.14 >= 7.7.0.0, < 7.7.1.9 >= 7.8.0.0, < 7.8.1.6 >= 8.1.1.0, < 8.1.1.2 >= 8.1.2.0, < 8.1.2.1 `cpe:2.3:o:ibm:storwize_v3500_firmware::::::::`
ibm	storwize_v9000_firmware	>= 6.1.0.0, < 7.5.0.14 >= 7.7.0.0, < 7.7.1.9 >= 7.8.0.0, < 7.8.1.6 >= 8.1.1.0, < 8.1.1.2 >= 8.1.2.0, < 8.1.2.1 `cpe:2.3:o:ibm:storwize_v9000_firmware::::::::`
ibm	san_volume_controller_firmware	>= 6.1.0.0, < 7.5.0.14 >= 7.7.0.0, < 7.7.1.9 >= 7.8.0.0, < 7.8.1.6 >= 8.1.1.0, < 8.1.1.2 >= 8.1.2.0, < 8.1.2.1 `cpe:2.3:o:ibm:san_volume_controller_firmware::::::::`
ibm	spectrum_virtualize	>= 6.1.0.0, < 7.5.0.14 >= 7.7.0.0, < 7.7.1.9 >= 7.8.0.0, < 7.8.1.6 >= 8.1.1.0, < 8.1.1.2 >= 8.1.2.0, < 8.1.2.1 `cpe:2.3:a:ibm:spectrum_virtualize::::::::`
ibm	spectrum_virtualize_for_public_cloud	>= 6.1.0.0, < 7.5.0.14 >= 7.7.0.0, < 7.7.1.9 >= 7.8.0.0, < 7.8.1.6 >= 8.1.1.0, < 8.1.1.2 >= 8.1.2.0, < 8.1.2.1 `cpe:2.3:a:ibm:spectrum_virtualize_for_public_cloud::::::::`

Original advisory text

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) could allow an authenticated user to obtain the private key which could make intercepting GUI communications possible. IBM X-Force ID: 140396.

References

http://www.ibm.com/support/docview.wss?uid=ssg1S1012263 Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ssg1S1012282 Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ssg1S1012283 Vendor Advisory
http://www.securityfocus.com/bid/104349 Third Party Advisory VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/140396 VDB Entry Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

5.3 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published17 May 2018

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-1465 · NVD

Track software like this

Free during beta