CVE-2018-1433: Infoleak

Q: What is the severity of CVE-2018-1433?

CVE-2018-1433 is classified as a high severity vulnerability, allowing unauthorized access to sensitive files.

Q: How do I fix CVE-2018-1433?

To fix CVE-2018-1433, apply the latest firmware updates provided by IBM for affected products.

Q: Which IBM products are affected by CVE-2018-1433?

CVE-2018-1433 affects several IBM products including IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize, and IBM FlashSystem across various firmware versions.

Q: What kind of files can be accessed through CVE-2018-1433?

CVE-2018-1433 allows attackers to read arbitrary files from the affected system due to lack of authentication.

Q: Is there a workaround for CVE-2018-1433?

Currently, there are no explicit workarounds for CVE-2018-1433, thus immediate patching is recommended.

Published May 17, 2018

Updated

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) web handler /DownloadFile does not require authentication to read arbitrary files from the system. IBM X-Force ID: 139473.

Affected Software

46 affected components

IBM Storwize V7000 Firmware>=6.1.0.0<7.5.0.14

IBM Storwize V7000 Firmware>=7.7.0.0<7.7.1.9

IBM Storwize V7000 Firmware>=7.8.0.0<7.8.1.6

IBM Storwize V7000 Firmware>=8.1.1.0<8.1.1.2

IBM Storwize V7000 Firmware>=8.1.2.0<8.1.2.1

IBM Storwize V7000

IBM Storwize V5000 Firmware>=6.1.0.0<7.5.0.14

IBM Storwize V5000 Firmware>=7.7.0.0<7.7.1.9

IBM Storwize V5000 Firmware>=7.8.0.0<7.8.1.6

IBM Storwize V5000 Firmware>=8.1.1.0<8.1.1.2

IBM Storwize V5000 Firmware>=8.1.2.0<8.1.2.1

IBM Storwize V5000

IBM Storwize V3700 Firmware>=6.1.0.0<7.5.0.14

IBM Storwize V3700 Firmware>=7.7.0.0<7.7.1.9

IBM Storwize V3700 Firmware>=7.8.0.0<7.8.1.6

IBM Storwize V3700 Firmware>=8.1.1.0<8.1.1.2

IBM Storwize V3700 Firmware>=8.1.2.0<8.1.2.1

IBM Storwize V3700

IBM Storwize V3500 Firmware>=6.1.0.0<7.5.0.14

IBM Storwize V3500 Firmware>=7.7.0.0<7.7.1.9

IBM Storwize V3500 Firmware>=7.8.0.0<7.8.1.6

IBM Storwize V3500 Firmware>=8.1.1.0<8.1.1.2

IBM Storwize V3500 Firmware>=8.1.2.0<8.1.2.1

IBM Storwize V3500

IBM Storwize V9000 Firmware>=6.1.0.0<7.5.0.14

IBM Storwize V9000 Firmware>=7.7.0.0<7.7.1.9

IBM Storwize V9000 Firmware>=7.8.0.0<7.8.1.6

IBM Storwize V9000 Firmware>=8.1.1.0<8.1.1.2

IBM Storwize V9000 Firmware>=8.1.2.0<8.1.2.1

IBM Storwize V9000

IBM San Volume Controller Firmware>=6.1.0.0<7.5.0.14

IBM San Volume Controller Firmware>=7.7.0.0<7.7.1.9

IBM San Volume Controller Firmware>=7.8.0.0<7.8.1.6

IBM San Volume Controller Firmware>=8.1.1.0<8.1.1.2

IBM San Volume Controller Firmware>=8.1.2.0<8.1.2.1

IBM SAN Volume Controller

IBM Spectrum Virtualize>=6.1.0.0<7.5.0.14

IBM Spectrum Virtualize>=7.7.0.0<7.7.1.9

IBM Spectrum Virtualize>=7.8.0.0<7.8.1.6

IBM Spectrum Virtualize>=8.1.1.0<8.1.1.2

IBM Spectrum Virtualize>=8.1.2.0<8.1.2.1

IBM Spectrum Virtualize For Public Cloud>=6.1.0.0<7.5.0.14

IBM Spectrum Virtualize For Public Cloud>=7.7.0.0<7.7.1.9

IBM Spectrum Virtualize For Public Cloud>=7.8.0.0<7.8.1.6

IBM Spectrum Virtualize For Public Cloud>=8.1.1.0<8.1.1.2

IBM Spectrum Virtualize For Public Cloud>=8.1.2.0<8.1.2.1

Event History

May 17, 2018

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-1433?

CVE-2018-1433 is classified as a high severity vulnerability, allowing unauthorized access to sensitive files.

How do I fix CVE-2018-1433?

To fix CVE-2018-1433, apply the latest firmware updates provided by IBM for affected products.

Which IBM products are affected by CVE-2018-1433?