IBM Spectrum Virtualize information disclosure

Vulnerability

A credential disclosure vulnerability exists in IBM Spectrum Virtualize 8.5. When an administrator uses the satask downloadsoftware command or the "Obtain the package directly" option in the GUI to download code from Fix Central, the IBMid credentials used to authenticate may be exposed. The issue occurs only while the download is in progress and under specific timing or network conditions [1]. Affected product versions are 8.5 for all IBM SAN Volume Controller, IBM Storwize, and IBM FlashSystem products running Spectrum Virtualize. The CVSS 3.0 base score is 5.9, with a high confidentiality impact but no impact on integrity or availability [1].

Exploitation

To exploit this vulnerability, an attacker must have network access to the administrative interface (GUI or CLI) of the affected system. The attacker must position themselves to observe the output of the download operation, such as by monitoring command output, viewing the GUI display, or capturing network traffic. They must also be able to trigger the download at a time when the credentials are transmitted. The vulnerability does not require authentication to the system, but the user initiating the download must have valid IBMid credentials, which could be inadvertently exposed to the attacker. The exact sequence involves the administrator starting a direct download from Fix Central, at which point the credentials may be visible in the output or logs under specific circumstances [1].

Impact

Successful exploitation leads to the disclosure of sensitive IBMid credential information (username and password). This could allow an attacker to impersonate the legitimate IBMid holder and access Fix Central or other IBM resources with that identity. The impact is limited to confidentiality; no integrity or availability of the Spectrum Virtualize system is compromised [1].

Mitigation

IBM recommends upgrading to IBM Spectrum Virtualize version 8.5.0.8 or 8.6.0.0, which contain the fix [1]. No workaround is provided beyond applying the patch. The vulnerability is not listed on the CISA KEV catalog. Users should follow the upgrade instructions in the referenced advisory to apply the update securely [1].