Vulnerability CVE-2018-1434 - CERT Civis.Net

Vulnerability Name:

CVE-2018-1434 (CCN-139474)

Assigned:

2017-12-13

Published:

2018-05-14

Updated:

2020-08-19

Summary:

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products ( 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) are vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 139474.

CVSS v3 Severity:

8.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
7.7 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

6.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
5.7 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): High Availibility (A): None

CVSS v2 Severity:

6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:C/A:N)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Complete Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2018-1434

Source: CCN
Type: IBM Security Bulletin S1012263 (Storwize V7000 (2076))
Multiple vulnerabilities in IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products

Source: CONFIRM
Type: Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ssg1S1012263

Source: CCN
Type: IBM Security Bulletin S1012282 (FlashSystem 840)
Multiple vulnerabilities affect the IBM FlashSystem models 840 and 900

Source: CONFIRM
Type: Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ssg1S1012282

Source: CCN
Type: IBM Security Bulletin S1012283 (FlashSystem V840)
Multiple vulnerabilities affect the IBM FlashSystem model V840

Source: CONFIRM
Type: Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ssg1S1012283

Source: CCN
Type: IBM Security Bulletin S1012293 (Storwize V7000 Unified (2073))
Multiple vulnerabilities affect the IBM Storwize V7000 Unified

Source: BID
Type: Third Party Advisory, VDB Entry
104349

Source: CCN
Type: BID-104349
Multiple IBM Products Multiple Security Vulnerabilities

Source: XF
Type: UNKNOWN
ibm-storwize-cve20181434-csrf(139474)

Source: XF
Type: VDB Entry, Vendor Advisory
ibm-storwize-cve20181434-csrf(139474)

Vulnerable Configuration:

Configuration 1:

cpe:/o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:* (Version >= 6.1.0.0 and < 7.5.0.14)

OR cpe:/o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:* (Version >= 7.7.0.0 and < 7.7.1.9)

OR cpe:/o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:* (Version >= 7.8.0.0 and < 7.8.1.6)

OR cpe:/o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:* (Version >= 8.1.1.0 and < 8.1.1.2)

OR cpe:/o:ibm:storwize_v7000_firmware:*:*:*:*:*:*:*:* (Version >= 8.1.2.0 and < 8.1.2.1)

AND

cpe:/h:ibm:storwize_v7000:-:*:*:*:*:*:*:*

Configuration 2:

cpe:/o:ibm:storwize_v5000_firmware:*:*:*:*:*:*:*:* (Version >= 6.1.0.0 and < 7.5.0.14)

OR cpe:/o:ibm:storwize_v5000_firmware:*:*:*:*:*:*:*:* (Version >= 7.7.0.0 and < 7.7.1.9)

OR cpe:/o:ibm:storwize_v5000_firmware:*:*:*:*:*:*:*:* (Version >= 7.8.0.0 and < 7.8.1.6)

OR cpe:/o:ibm:storwize_v5000_firmware:*:*:*:*:*:*:*:* (Version >= 8.1.1.0 and < 8.1.1.2)

OR cpe:/o:ibm:storwize_v5000_firmware:*:*:*:*:*:*:*:* (Version >= 8.1.2.0 and < 8.1.2.1)

AND

cpe:/h:ibm:storwize_v5000:-:*:*:*:*:*:*:*

Configuration 3:

cpe:/o:ibm:storwize_v3700_firmware:*:*:*:*:*:*:*:* (Version >= 6.1.0.0 and < 7.5.0.14)

OR cpe:/o:ibm:storwize_v3700_firmware:*:*:*:*:*:*:*:* (Version >= 7.7.0.0 and < 7.7.1.9)

OR cpe:/o:ibm:storwize_v3700_firmware:*:*:*:*:*:*:*:* (Version >= 7.8.0.0 and < 7.8.1.6)

OR cpe:/o:ibm:storwize_v3700_firmware:*:*:*:*:*:*:*:* (Version >= 8.1.1.0 and < 8.1.1.2)

OR cpe:/o:ibm:storwize_v3700_firmware:*:*:*:*:*:*:*:* (Version >= 8.1.2.0 and < 8.1.2.1)

AND

cpe:/h:ibm:storwize_v3700:-:*:*:*:*:*:*:*

Configuration 4:

cpe:/o:ibm:storwize_v3500_firmware:*:*:*:*:*:*:*:* (Version >= 6.1.0.0 and < 7.5.0.14)

OR cpe:/o:ibm:storwize_v3500_firmware:*:*:*:*:*:*:*:* (Version >= 7.7.0.0 and < 7.7.1.9)

OR cpe:/o:ibm:storwize_v3500_firmware:*:*:*:*:*:*:*:* (Version >= 7.8.0.0 and < 7.8.1.6)

OR cpe:/o:ibm:storwize_v3500_firmware:*:*:*:*:*:*:*:* (Version >= 8.1.1.0 and < 8.1.1.2)

OR cpe:/o:ibm:storwize_v3500_firmware:*:*:*:*:*:*:*:* (Version >= 8.1.2.0 and < 8.1.2.1)

AND

cpe:/h:ibm:storwize_v3500:-:*:*:*:*:*:*:*

Configuration 5:

cpe:/o:ibm:storwize_v9000_firmware:*:*:*:*:*:*:*:* (Version >= 6.1.0.0 and < 7.5.0.14)

OR cpe:/o:ibm:storwize_v9000_firmware:*:*:*:*:*:*:*:* (Version >= 7.7.0.0 and < 7.7.1.9)

OR cpe:/o:ibm:storwize_v9000_firmware:*:*:*:*:*:*:*:* (Version >= 7.8.0.0 and < 7.8.1.6)

OR cpe:/o:ibm:storwize_v9000_firmware:*:*:*:*:*:*:*:* (Version >= 8.1.1.0 and < 8.1.1.2)

OR cpe:/o:ibm:storwize_v9000_firmware:*:*:*:*:*:*:*:* (Version >= 8.1.2.0 and < 8.1.2.1)

AND

cpe:/h:ibm:storwize_v9000:-:*:*:*:*:*:*:*

Configuration 6:

cpe:/o:ibm:san_volume_controller_firmware:*:*:*:*:*:*:*:* (Version >= 6.1.0.0 and < 7.5.0.14)

OR cpe:/o:ibm:san_volume_controller_firmware:*:*:*:*:*:*:*:* (Version >= 7.7.0.0 and < 7.7.1.9)

OR cpe:/o:ibm:san_volume_controller_firmware:*:*:*:*:*:*:*:* (Version >= 7.8.0.0 and < 7.8.1.6)

OR cpe:/o:ibm:san_volume_controller_firmware:*:*:*:*:*:*:*:* (Version >= 8.1.1.0 and < 8.1.1.2)

OR cpe:/o:ibm:san_volume_controller_firmware:*:*:*:*:*:*:*:* (Version >= 8.1.2.0 and < 8.1.2.1)

AND

cpe:/h:ibm:san_volume_controller:-:*:*:*:*:*:*:*

Configuration 7:

cpe:/a:ibm:spectrum_virtualize:*:*:*:*:*:*:*:* (Version >= 6.1.0.0 and < 7.5.0.14)

OR cpe:/a:ibm:spectrum_virtualize:*:*:*:*:*:*:*:* (Version >= 7.7.0.0 and < 7.7.1.9)

OR cpe:/a:ibm:spectrum_virtualize:*:*:*:*:*:*:*:* (Version >= 7.8.0.0 and < 7.8.1.6)

OR cpe:/a:ibm:spectrum_virtualize:*:*:*:*:*:*:*:* (Version >= 8.1.1.0 and < 8.1.1.2)

OR cpe:/a:ibm:spectrum_virtualize:*:*:*:*:*:*:*:* (Version >= 8.1.2.0 and < 8.1.2.1)

Configuration 8:

cpe:/a:ibm:spectrum_virtualize_for_public_cloud:*:*:*:*:*:*:*:* (Version >= 6.1.0.0 and < 7.5.0.14)

OR cpe:/a:ibm:spectrum_virtualize_for_public_cloud:*:*:*:*:*:*:*:* (Version >= 7.7.0.0 and < 7.7.1.9)

OR cpe:/a:ibm:spectrum_virtualize_for_public_cloud:*:*:*:*:*:*:*:* (Version >= 7.8.0.0 and < 7.8.1.6)

OR cpe:/a:ibm:spectrum_virtualize_for_public_cloud:*:*:*:*:*:*:*:* (Version >= 8.1.1.0 and < 8.1.1.2)

OR cpe:/a:ibm:spectrum_virtualize_for_public_cloud:*:*:*:*:*:*:*:* (Version >= 8.1.2.0 and < 8.1.2.1)

Configuration CCN 1:

cpe:/a:ibm:san_volume_controller_software:6.1.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:san_volume_controller_software:6.2.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:san_volume_controller_software:6.3.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:san_volume_controller_software:6.4.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:7.1:*:*:*:*:*:*:*

OR cpe:/o:ibm:san_volume_controller_firmware:7.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:6.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:6.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:7.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:7.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:6.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.7.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:7.8.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:8.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v7000_software:8.1.1:*:*:*:*:*:*:*

OR cpe:/o:ibm:san_volume_controller_firmware:7.5:*:*:*:*:*:*:*

OR cpe:/o:ibm:san_volume_controller_firmware:7.6:*:*:*:*:*:*:*

OR cpe:/o:ibm:san_volume_controller_firmware:7.6.1:*:*:*:*:*:*:*

OR cpe:/o:ibm:san_volume_controller_firmware:7.7:*:*:*:*:*:*:*

OR cpe:/o:ibm:san_volume_controller_firmware:7.7.1:*:*:*:*:*:*:*

OR cpe:/o:ibm:san_volume_controller_firmware:7.8:*:*:*:*:*:*:*

OR cpe:/o:ibm:san_volume_controller_firmware:7.8.1:*:*:*:*:*:*:*

OR cpe:/o:ibm:san_volume_controller_firmware:8.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:7.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:7.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:7.6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:7.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:7.7.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:7.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:7.8.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:8.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:7.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:7.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:7.6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:7.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:7.7.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:7.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:7.8.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:8.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:7.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:7.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:7.6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:7.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:7.7.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:7.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:7.8.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:8.1:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:7.5:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:7.6:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:7.6.1:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:7.7:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:7.7.1:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:7.8:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:7.8.1:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:8.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:7.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:7.6:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:7.6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:7.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:7.7.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:7.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:7.8.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:8.1:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:6.1:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:6.2:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:6.3:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:6.4:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:7.1:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:7.2:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:7.3:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:7.4:*:*:*:*:*:*:*

OR cpe:/o:ibm:flashsystem_v9000_firmware:8.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:6.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:6.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:6.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:7.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:7.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:7.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:7.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:spectrum_virtualize:8.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:6.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:6.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:7.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:7.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:7.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3500_software:8.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:6.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:6.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:7.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:7.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:7.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v3700_software:8.1.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:6.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:6.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:6.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:6.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:7.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:7.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:7.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:storwize_v5000_software:8.1.1:*:*:*:*:*:*:*

AND

cpe:/a:ibm:storwize_v7000_unified_software:1.6:*:*:*:*:*:*:*

Denotes that component is vulnerable