CVE-2018-1463

Vulnerability

IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize, and IBM FlashSystem products (versions 6.1, 6.2, 6.3, 6.4, 7.1, 7.2, 7.3, 7.4, 7.5, 7.6, 7.6.1, 7.7, 7.7.1, 7.8, 7.8.1, 8.1, and 8.1.1) contain a vulnerability that allows an authenticated user to access system files they should not have access to, some of which may contain account credentials [1][2][3].

Exploitation

An attacker with valid authentication to the affected system can exploit this vulnerability by accessing specific web handlers or commands that read arbitrary files. No user interaction is required beyond authentication [1][2][3].

Impact

Successful exploitation allows the attacker to read sensitive system files, including files that contain account credentials. This leads to information disclosure and could enable further unauthorized access or privilege escalation [1][2][3].

Mitigation

IBM has released firmware updates to address this vulnerability. Affected users should apply the latest firmware version for their product as specified in the relevant security bulletins [1][2][3]. As of the publication date (2018-05-17), no workarounds are documented.