CVE-2023-49877

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-49877
IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote authenticated user to obtain sensitive information, caused by improper filtering of URLs. By submitting a specially crafted HTTP GET request, an attacker could exploit this vulnerability to view application source code, system configuration information, or other sensitive data related to the Management Interface. IBM X-Force ID: 272651.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/272651 VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/7092383 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:ibm:virtualization_engine_ts7760_3957-vec_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ibm:virtualization_engine_ts7760_3957-vec:r5.2.1:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:ibm:virtualization_engine_ts7760_3957-vec_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ibm:virtualization_engine_ts7760_3957-vec:r5.3:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:o:ibm:virtualization_engine_ts7770_3957-ved_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ibm:virtualization_engine_ts7770_3957-ved:r5.2.1:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:ibm:virtualization_engine_ts7770_3957-ved_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ibm:virtualization_engine_ts7770_3957-ved:r5.3:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:ibm:virtualization_engine_ts7770_3948-ved_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ibm:virtualization_engine_ts7770_3948-ved:r5.3:*:*:*:*:*:*:*
History

19 Dec 2023, 02:08

Type Values Removed Values Added
References () https://exchange.xforce.ibmcloud.com/vulnerabilities/272651 - () https://exchange.xforce.ibmcloud.com/vulnerabilities/272651 - VDB Entry, Vendor Advisory
References () https://www.ibm.com/support/pages/node/7092383 - () https://www.ibm.com/support/pages/node/7092383 - Vendor Advisory
First Time Ibm virtualization Engine Ts7770 3948-ved
Ibm virtualization Engine Ts7760 3957-vec
Ibm virtualization Engine Ts7770 3957-ved
Ibm virtualization Engine Ts7770 3957-ved Firmware
Ibm virtualization Engine Ts7770 3948-ved Firmware
Ibm virtualization Engine Ts7760 3957-vec Firmware
Ibm
CPE cpe:2.3:h:ibm:virtualization_engine_ts7760_3957-vec:r5.2.1:*:*:*:*:*:*:*
cpe:2.3:h:ibm:virtualization_engine_ts7770_3957-ved:r5.3:*:*:*:*:*:*:*
cpe:2.3:o:ibm:virtualization_engine_ts7760_3957-vec_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ibm:virtualization_engine_ts7770_3957-ved:r5.2.1:*:*:*:*:*:*:*
cpe:2.3:h:ibm:virtualization_engine_ts7770_3948-ved:r5.3:*:*:*:*:*:*:*
cpe:2.3:o:ibm:virtualization_engine_ts7770_3948-ved_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:ibm:virtualization_engine_ts7760_3957-vec:r5.3:*:*:*:*:*:*:*
cpe:2.3:o:ibm:virtualization_engine_ts7770_3957-ved_firmware:*:*:*:*:*:*:*:*
Summary
  • (es) IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED y 3957-VEC podría permitir que un usuario autenticado remotamente obtenga información confidencial, causada por un filtrado inadecuado de las URL. Al enviar una solicitud HTTP GET especialmente manipulada, un atacante podría aprovechar esta vulnerabilidad para ver el código fuente de la aplicación, información de configuración del sistema u otros datos confidenciales relacionados con la interfaz de administración. ID de IBM X-Force: 272651.

13 Dec 2023, 21:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-12-13 21:15

Updated : 2023-12-19 02:08

NVD link : CVE-2023-49877

Mitre link : CVE-2023-49877

CVE.ORG link : CVE-2023-49877

JSON object : View

Products Affected

ibm

  • virtualization_engine_ts7770_3948-ved
  • virtualization_engine_ts7770_3957-ved
  • virtualization_engine_ts7760_3957-vec_firmware
  • virtualization_engine_ts7770_3957-ved_firmware
  • virtualization_engine_ts7770_3948-ved_firmware
  • virtualization_engine_ts7760_3957-vec
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor