description: IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to download arbitrary files from the operating system. IBM X-Force ID: 148757.
problem types: Obtain Information
affected:
{
product: torwize V7000
vendor: IBM
versions:
status: affected, version: 7.5
status: affected, version: 8.2
}
{
product: torwize V3500
vendor: IBM
versions:
status: affected, version: 7.5
status: affected, version: 8.2
}
{
product: torwize V3700
vendor: IBM
versions:
status: affected, version: 7.5
status: affected, version: 8.2
}
{
product: Spectrum Virtualize for Public Cloud
vendor: IBM
versions:
status: affected, version: 7.5
status: affected, version: 8.2
}
{
product: Spectrum Virtualize Software
vendor: IBM
versions:
status: affected, version: 7.5
status: affected, version: 8.2
}
{
product: SAN Volume Controller
vendor: IBM
versions:
status: affected, version: 7.5
status: affected, version: 8.2
}
{
product: FlashSystem V9000
vendor: IBM
versions:
status: affected, version: 7.5
status: affected, version: 8.2
}
{
product: torwize V5000
vendor: IBM
versions:
status: affected, version: 7.5
status: affected, version: 8.2
}
{
product: FlashSystem 9100 Family
vendor: IBM
versions:
status: affected, version: 7.5
status: affected, version: 8.2
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
exploitCodeMaturity: UNPROVEN
integrityImpact: NONE
privilegesRequired: LOW
remediationLevel: TEMPORARY_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 5.7
temporalSeverity: MEDIUM
userInteraction: NONE
vectorString: CVSS:3.0/A:N/AC:L/AV:N/C:H/I:N/PR:L/S:U/UI:N/E:U/RC:C/RL:T
version: 3.0
]