Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveIbmCVE-2023-35897
HistoryOct 06, 2023 - 2:15 p.m.

CVE-2023-35897

2023-10-0614:15:11
CWE-427
CWE-94
ibm
web.nvd.nist.gov
49
ibm
spectrum protect
storage protect
virtual environments
8.1.0.0
8.1.19.0
local code execution
dll hijacking
cve-2023-35897
nvd

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0

Percentile

13.2%

JSON

IBM Spectrum Protect Client and IBM Storage Protect for Virtual Environments 8.1.0.0 through 8.1.19.0 could allow a local user to execute arbitrary code on the system using a specially crafted file, caused by a DLL hijacking flaw. IBM X-Force ID: 259246.

Affected configurations

Nvd
Vulners
Vulnrichment
Node
ibmstorage_protectRange8.1.0.0–8.1.19.0virtual_environments\_data_protection_for_hyper-v
OR
ibmstorage_protectRange8.1.0.0–8.1.19.0virtual_environments\_data_protection_for_vmware
OR
ibmstorage_protect_clientRange8.1.0.0–8.1.19.0
VendorProductVersionCPE
ibmstorage_protect*cpe:2.3:a:ibm:storage_protect:*:*:*:*:virtual_environments\:_data_protection_for_hyper-v:*:*:*
ibmstorage_protect*cpe:2.3:a:ibm:storage_protect:*:*:*:*:virtual_environments\:_data_protection_for_vmware:*:*:*
ibmstorage_protect_client*cpe:2.3:a:ibm:storage_protect_client:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Storage Protect Client",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "8.1.19.0",
        "status": "affected",
        "version": "8.1.0.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Storage Protect for Virtual Environments",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "8.1.19.0",
        "status": "affected",
        "version": "8.1.0.0",
        "versionType": "semver"
      }
    ]
  }
]

Related

ibm 1
prion 1
vulnrichment 1
nvd 1
cvelist 1
ibm
ibm
Security Bulletin: IBM Storage Protect Backup-Archive Client and IBM Storage Protect for Virtual Environments are vulnerable to arbitrary code execution due to a DLL hijacking flaw (CVE-2023-35897)
2023-10-04 13:00:53
prion
prion
Code injection
2023-10-06 14:15:00
vulnrichment
vulnrichment
CVE-2023-35897 IBM Spectrum Protect code execution
2023-10-06 13:06:34
nvd
nvd
CVE-2023-35897
2023-10-06 14:15:11
cvelist
cvelist
CVE-2023-35897 IBM Spectrum Protect code execution
2023-10-06 13:06:34

CVSS3

8.4

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0

Percentile

13.2%

JSON
Related for CVE-2023-35897
ibm1prion1vulnrichment1nvd1cvelist1