{"id":"CVE-2018-1775","state":"PUBLISHED","title":"IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to download arbitrary files","description":"IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to download arbitrary files from the operating system. IBM X-Force ID: 148757.","publishedAt":"2019-02-27T22:00:00.000Z","updatedAt":"2024-09-16T18:43:43.401Z","severity":{"score":6.5,"label":"Medium","version":"3.0","vector":"CVSS:3.0/A:N/AC:L/AV:N/C:H/I:N/PR:L/S:U/UI:N/E:U/RC:C/RL:T","source":"ibm"},"assigner":"ibm","products":["IBM torwize V7000","IBM torwize V3500","IBM torwize V3700","IBM Spectrum Virtualize for Public Cloud","IBM Spectrum Virtualize Software","IBM SAN Volume Controller","IBM FlashSystem V9000","IBM torwize V5000","IBM FlashSystem 9100 Family"],"affected":[{"vendor":"IBM","product":"torwize V7000","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"torwize V3500","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"torwize V3700","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"Spectrum Virtualize for Public Cloud","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"Spectrum Virtualize Software","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"SAN Volume Controller","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"FlashSystem V9000","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"torwize V5000","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"FlashSystem 9100 Family","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]}],"references":["http://www.securityfocus.com/bid/107187","https://exchange.xforce.ibmcloud.com/vulnerabilities/148757","https://www.ibm.com/support/docview.wss?uid=ibm10872486"],"weaknesses":[],"ingestedAt":"2026-10-29T19:44:36.861Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2018/1xxx/CVE-2018-1775.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2018-1775","state":"PUBLISHED","datePublished":"2019-02-27T22:00:00.000Z","dateUpdated":"2024-09-16T18:43:43.401Z","assignerShortName":"ibm","assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","dateReserved":"2017-12-13T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to download arbitrary files from the operating system. IBM X-Force ID: 148757."}],"affected":[{"vendor":"IBM","product":"torwize V7000","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"torwize V3500","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"torwize V3700","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"Spectrum Virtualize for Public Cloud","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"Spectrum Virtualize Software","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"SAN Volume Controller","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"FlashSystem V9000","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"torwize V5000","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]},{"vendor":"IBM","product":"FlashSystem 9100 Family","versions":[{"version":"7.5","status":"affected"},{"version":"8.2","status":"affected"}]}],"references":[{"url":"http://www.securityfocus.com/bid/107187","name":"107187","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/148757","name":"ibm-storwize-cve20181775-file-download(148757)","tags":["vdb-entry","x_refsource_XF"]},{"url":"https://www.ibm.com/support/docview.wss?uid=ibm10872486","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_0":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.5,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","exploitCodeMaturity":"UNPROVEN","integrityImpact":"NONE","privilegesRequired":"LOW","remediationLevel":"TEMPORARY_FIX","reportConfidence":"CONFIRMED","scope":"UNCHANGED","temporalScore":5.7,"temporalSeverity":"MEDIUM","userInteraction":"NONE","vectorString":"CVSS:3.0/A:N/AC:L/AV:N/C:H/I:N/PR:L/S:U/UI:N/E:U/RC:C/RL:T","version":"3.0"}}],"problemTypes":[{"descriptions":[{"description":"Obtain Information","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"ibm","dateUpdated":"2019-03-01T10:57:01.000Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522"},"datePublic":"2019-02-25T00:00:00.000Z","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","DATE_PUBLIC":"2019-02-25T00:00:00","ID":"CVE-2018-1775","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"torwize V7000","version":{"version_data":[{"version_value":"7.5"},{"version_value":"8.2"}]}},{"product_name":"torwize V3500","version":{"version_data":[{"version_value":"7.5"},{"version_value":"8.2"}]}},{"product_name":"torwize V3700","version":{"version_data":[{"version_value":"7.5"},{"version_value":"8.2"}]}},{"product_name":"Spectrum Virtualize for Public Cloud","version":{"version_data":[{"version_value":"7.5"},{"version_value":"8.2"}]}},{"product_name":"Spectrum Virtualize Software","version":{"version_data":[{"version_value":"7.5"},{"version_value":"8.2"}]}},{"product_name":"SAN Volume Controller","version":{"version_data":[{"version_value":"7.5"},{"version_value":"8.2"}]}},{"product_name":"FlashSystem V9000","version":{"version_data":[{"version_value":"7.5"},{"version_value":"8.2"}]}},{"product_name":"torwize V5000","version":{"version_data":[{"version_value":"7.5"},{"version_value":"8.2"}]}},{"product_name":"FlashSystem 9100 Family","version":{"version_data":[{"version_value":"7.5"},{"version_value":"8.2"}]}}]},"vendor_name":"IBM"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products versions 7.5 through 8.2 could allow an authenticated user to download arbitrary files from the operating system. IBM X-Force ID: 148757."}]},"impact":{"cvssv3":{"BM":{"A":"N","AC":"L","AV":"N","C":"H","I":"N","PR":"L","S":"U","UI":"N"},"TM":{"E":"U","RC":"C","RL":"T"}}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Obtain Information"}]}]},"references":{"reference_data":[{"name":"107187","refsource":"BID","url":"http://www.securityfocus.com/bid/107187"},{"name":"ibm-storwize-cve20181775-file-download(148757)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/148757"},{"name":"https://www.ibm.com/support/docview.wss?uid=ibm10872486","refsource":"CONFIRM","url":"https://www.ibm.com/support/docview.wss?uid=ibm10872486"}]}}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.securityfocus.com/bid/107187","name":"107187","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/148757","name":"ibm-storwize-cve20181775-file-download(148757)","tags":["vdb-entry","x_refsource_XF","x_transferred"]},{"url":"https://www.ibm.com/support/docview.wss?uid=ibm10872486","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-05T04:07:44.355Z"}}]}}}