9.8crit
CVE-2018-1822
IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
3.4%
percentile 89%
Public exploits
0
none known
Summary
IBM FlashSystem 900 product GUI allows a specially crafted attack to bypass the authentication requirements of the system, resulting in the ability to remotely change the superuser password. This can be used by an attacker to gain administrative control or to deny service. IBM X-Force ID: 150296.
Exploit prediction (EPSS)
3.43% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 9.8 | CVSS:3.0/A:H/AC:L/AV:N/C:H/I:H/PR:N/S:U/UI:N/E:U/RC:C/RL:O |
| CNA | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- IBM FlashSystem 900
Classification
- Weakness
- CWE-287 Improper Authentication
References
- exchange.xforce.ibmcloud.com /vulnerabilities/150296 · vdb-entry, x_refsource_XF, x_transferred
- ibm.com /support/docview.wss?uid=ibm10732962 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-1822
- NVD: CVE-2018-1822
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.