IBM Spectrum Protect Plus vulnerabilities, page 3
51 vulnerabilities
Known vulnerabilities in IBM Spectrum Protect Plus, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
MediumCVE-2022-40234ibm · spectrum_protect_plusibm spectrum_protect_plusVersions of IBM Spectrum Protect Plus prior to 10.1.12 (excluding 10.1.12) include the private key information for a certificate inside the generated .crt file when uploading a TLS certificate to IBM Spectrum Protect Plus. If this generated .crt file is shared, an attacker can obtain the private key information for the uploaded certificate. IBM X-Force ID: 235718.EPSS0.61%HighCVE-2022-40608ibm · spectrum_protect_plusibm spectrum_protect_plusIBM Spectrum Protect Plus 10.1.6 through 10.1.11 Microsoft File Systems restore operation can download any file on the target machine by manipulating the URL with a directory traversal attack. This results in the restore operation gaining access to files which the operator should not have access to. IBM X-Force ID: 235873.EPSS1.84%HighCVE-2022-22396ibm · spectrum_protect_plusibm spectrum_protect_plusCredentials are printed in clear text in the IBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.3 virgo log file in certain cases. Credentials could be the remote vSnap, offload targets, or VADP credentials depending on the operation performed. Credentials that are using API key or certificate are not printed. IBM X-Force ID: 222231.EPSS0.71%HighCVE-2022-22472ibm · spectrum_protect_plus +1 moreibm spectrum_protect_plusIBM Spectrum Protect Plus Container Backup and Restore (10.1.5 through 10.1.10.2 for Kubernetes and 10.1.7 through 10.1.10.2 for Red Hat OpenShift) could allow a remote attacker to bypass IBM Spectrum Protect Plus role based access control restrictions, caused by improper disclosure of session information. By retrieving the logs of a container an attacker could exploit this vulnerability to bypass login security of the IBM Spectrum Protect Plus server and gain unauthorized access based on the permissions of the IBM Spectrum Protect Plus user to the vulnerable Spectrum Protect Plus server software. IBM X-Force ID: 225340.EPSS0.89%HighCVE-2022-22354ibm · spectrum_copy_data_management +1 moreibm spectrum_copy_data_managementIBM Spectrum Protect Plus 10.1.0.0 through 10.1.9.2 and IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.14.3 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the Admin Console to become unresponsive. IBM X-Force ID: 220485.EPSS0.94%MediumCVE-2019-4703ibm · spectrum_protect_plusibm spectrum_protect_plusIBM Spectrum Protect Plus 10.1.0 and 10.5.0, when protecting Microsoft SQL or Microsoft Exchange, could allow an attacker with intimate knowledge of the system to obtain highly sensitive information.EPSS0.46%HighCVE-2019-4652ibm · spectrum_protect_plusibm spectrum_protect_plusIBM Spectrum Protect Plus 10.1.0 through 10.1.4 uses insecure file permissions on restored files and directories in Windows which could allow a local user to obtain sensitive information or perform unauthorized actions. IBM X-Force ID: 170963.EPSS0.27%MediumCVE-2019-4385ibm · spectrum_protect_plusibm spectrum_protect_plusIBM Spectrum Protect Plus 10.1.2 may display the vSnap CIFS password in the IBM Spectrum Protect Plus Joblog. This can result in an attacker gaining access to sensitive information as well as vSnap. IBM X-Force ID: 162173.EPSS0.33%HighCVE-2019-4383ibm · spectrum_protect_plusibm spectrum_protect_plusWhen using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle or MongoDB databases, a redirected restore operation may result in an escalation of user privileges. IBM X-Force ID: 162165.EPSS0.40%HighCVE-2019-4357ibm · spectrum_protect_plusibm spectrum_protect_plusWhen using IBM Spectrum Protect Plus 10.1.0, 10.1.2, and 10.1.3 to protect Oracle, DB2 or MongoDB databases, a redirected restore operation specifying a target path may allow execution of arbitrary code on the system. IBM X-Force ID: 161667,EPSS0.46%HighCVE-2023-47148ibm · spectrum_protect_plus +1 moreIBM Storage Protect Plus Server information disclosureIBM Storage Protect Plus Server 10.1.0 through 10.1.15.2 Admin Console could allow a remote attacker to obtain sensitive information due to improper validation of unsecured endpoints which could be used in further attacks against the system. IBM X-Force ID: 270599.EPSS0.61%