CVE-2018-1447

CVSS 5.1 MEDIUMEPSS 0.9%

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.1EPSS 0.9%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

04 abr 2018Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The GSKit (IBM Spectrum Protect 7.1 and 7.2) and (IBM Spectrum Protect Snapshot 4.1.3, 4.1.4, and 4.1.6) CMS KDB logic fails to salt the hash function resulting in weaker than expected protection of passwords. A weak password may be recovered. Note: After update the customer should change password to ensure the new password is stored more securely. Products should encourage customers to take this step as a high priority action. IBM X-Force ID: 139972.

CVSS:3.0/A:N/AC:H/AV:L/C:H/I:N/PR:N/S:U/UI:N

Produtos afetados

IBM · Spectrum Protect IBM · Spectrum Protect for Space Management IBM · Spectrum Protect for Virtual Environments IBM · Spectrum Protect Snapshot

Referências

https://exchange.xforce.ibmcloud.com/vulnerabilities/139972 http://www.ibm.com/support/docview.wss?uid=swg22014669 http://www.ibm.com/support/docview.wss?uid=swg22014957 http://www.ibm.com/support/docview.wss?uid=swg22015066 http://www.ibm.com/support/docview.wss?uid=swg22015071 http://www.securityfocus.com/bid/104511 http://www.securitytracker.com/id/1041012