CVE-2012-6354

2013-02-1919:55:00

CWE-287

[email protected]

web.nvd.nist.gov

ibm

san volume controller

storwize v7000

authentication bypass

superuser access

cve-2012-6354

nvd

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

7 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

76.1%

JSON

The management GUI on the IBM SAN Volume Controller and Storwize V7000 6.x before 6.4.1.3 allows remote attackers to bypass authentication and obtain superuser access via IP packets.

Affected configurations

NVD

Node

ibmsan_volume_controller_softwareMatch6.1.0.0

ibmsan_volume_controller_softwareMatch6.2.0.0

ibmsan_volume_controller_softwareMatch6.3.0.0

ibmsan_volume_controller_softwareMatch6.4.0.0

ibmstorwize_v7000Match-

CPENameOperatorVersion
ibm:san_volume_controller_softwareibm san volume controller softwareeq6.1.0.0
ibm:san_volume_controller_softwareibm san volume controller softwareeq6.2.0.0
ibm:san_volume_controller_softwareibm san volume controller softwareeq6.3.0.0
ibm:san_volume_controller_softwareibm san volume controller softwareeq6.4.0.0
ibm:storwize_v7000ibm storwize v7000eq-

CPE	Name	Operator	Version
ibm:san_volume_controller_software	ibm san volume controller software	eq	6.1.0.0
ibm:san_volume_controller_software	ibm san volume controller software	eq	6.2.0.0
ibm:san_volume_controller_software	ibm san volume controller software	eq	6.3.0.0
ibm:san_volume_controller_software	ibm san volume controller software	eq	6.4.0.0
ibm:storwize_v7000	ibm storwize v7000	eq	-