CVE-2018-1447

CVSS 5.1 MEDIUMEPSS 0.9%

Vexday Risk Score

13Bajo

Decisión SSVC (CISA)

Track

Sin señal de explotación → monitorear

CVSS 5.1EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

04 abr 2018Publicada en NVD

Recomendación: Monitorear — sin señal de explotación por ahora.

The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action. IBM X-Force ID: 139972.

CVSS:3.0/A:N/AC:H/AV:L/C:H/I:N/PR:N/S:U/UI:N

Productos afectados

IBM · Spectrum Protect IBM · Spectrum Protect for Space Management IBM · Spectrum Protect for Virtual Environments IBM · Spectrum Protect Snapshot

Referencias

https://exchange.xforce.ibmcloud.com/vulnerabilities/139972 http://www.ibm.com/support/docview.wss?uid=swg22014669 http://www.ibm.com/support/docview.wss?uid=swg22014957 http://www.ibm.com/support/docview.wss?uid=swg22015066 http://www.ibm.com/support/docview.wss?uid=swg22015071 http://www.securityfocus.com/bid/104511 http://www.securitytracker.com/id/1041012