SB2023022240 - Improper input validation in IBM FlashSystem 840 and 900

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023022240

SB2023022240 - Improper input validation in IBM FlashSystem 840 and 900

Published: February 22, 2023

Security Bulletin ID SB2023022240
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper input validation (CVE-ID: CVE-2018-11776)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient input validation in cases where namespace value isn't set for a result defined in underlying xml configurations and in same time, its upper action(s) configurations have no or wildcard namespace, or when using url tag which doesn’t have value and action set and in same time, its upper action(s) configurations have no or wildcard namespace.

A remote unauthenticated attacker can compromise the affected system.


Remediation

Install update from vendor's website.

References