Description
IBM FlashSystem (IBM Storage Virtualize (8.5.0.0 through 8.5.0.13, 8.5.1.0, 8.5.2.0 through 8.5.2.3, 8.5.3.0 through 8.5.3.1, 8.5.4.0, 8.6.0.0 through 8.6.0.5, 8.6.1.0, 8.6.2.0 through 8.6.2.1, 8.6.3.0, 8.7.0.0 through 8.7.0.2, 8.7.1.0, 8.7.2.0 through 8.7.2.1) could allow a remote attacker to bypass RPCAdapter endpoint authentication by sending a specifically crafted HTTP request.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| IBM | Storage Virtualize | 8.5.0.0 – ≤ 8.5.0.13, 8.5.1.0, 8.5.2.0 – ≤ 8.5.2.3, 8.5.3.0 – ≤ 8.5.3.1, 8.5.4.0, 8.6.0.0 – ≤ 8.6.0.5, 8.6.1.0, 8.6.2.0 – ≤ 8.6.2.1, 8.6.3.0, 8.7.1.0, 8.7.2.0 – ≤ 8.7.2.1 | — |
Advisories 2
- NCSC-2025-0074 Kwetsbaarheden verholpen in IBM Storage producten NCSC-NL (Netherlands) · Mar 4, 2025
- WID-SEC-2025-0466 IBM Storage Virtualize Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 2, 2025
References
- https://www.ibm.com/support/pages/node/7184182 vendor-advisory