SB2023030124 - Improper input validation in IBM SAN Volume Controller and Storwize Family

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023030124

SB2023030124 - Improper input validation in IBM SAN Volume Controller and Storwize Family

Published: March 1, 2023

Security Bulletin ID SB2023030124
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Improper input validation (CVE-ID: CVE-2018-11776)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient input validation in cases where namespace value isn't set for a result defined in underlying xml configurations and in same time, its upper action(s) configurations have no or wildcard namespace, or when using url tag which doesn’t have value and action set and in same time, its upper action(s) configurations have no or wildcard namespace.

A remote unauthenticated attacker can compromise the affected system.


Remediation

Install update from vendor's website.

References