CVE-2014-3077

IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

CVSS v2.0 2.1 LOW

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004837	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/93906
http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004837	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/93906

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.3.0.0:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.3.2.0:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.3.2.3:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.0.0:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.0.4:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.1.0:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.1.1:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.2.0:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.3.0:::::::*
	cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.3.3:::::::*

cpe:2.3:h:ibm:storwize_unified_v7000:-:*:*:*:*:*:*:*

History

21 Nov 2024, 02:07

Type	Values Removed	Values Added
References	~~() http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004837 - Vendor Advisory~~	() http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004837 - Vendor Advisory
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/93906 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/93906 -

Information

Published : 2014-09-15 14:55

Updated : 2024-11-21 02:07

NVD link : CVE-2014-3077

Mitre link : CVE-2014-3077

CVE.ORG link : CVE-2014-3077

JSON object : View

Products Affected

ibm

storwize_unified_v7000
storwize_v7000_unified_software

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2014-3077", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-09-15T14:55:11.260", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004837", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/93906", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004837", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/93906", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file."}, {"lang": "es", "value": "IBM SONAS y System Storage Storwize V7000 Unified (tambi\u00e9n conocido como V7000U) 1.3.x y 1.4.x anterior a 1.4.3.4 almacena la contrase\u00f1a chkauth en el registro de auditor\u00eda, lo que permite a usuarios locales obtener informaci\u00f3n sensible mediante la lectura del registro."}], "lastModified": "2024-11-21T02:07:25.433", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.3.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C2890B04-AB96-4B1F-90B0-3F365FD6EF0D"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.3.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE9CC5C3-AE3E-4A24-B35B-3CD35D6D4414"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.3.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BAEA5EAD-5341-429C-9DD4-DEB311485D68"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F9B4C74-9135-4775-AC09-D79BEFF2BD3E"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E1420861-4678-4282-BFD7-5933C48269F6"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02299B18-7BD4-4F39-A5FA-6FFE92F9A12D"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C1FF672-811A-43AF-B7C8-61FF78952B7F"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "63BD0102-EDB1-46D6-9EF1-D4002BCDBE14"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.3.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D522173E-9C93-445A-B0DA-B11614C2DDCD"}, {"criteria": "cpe:2.3:a:ibm:storwize_v7000_unified_software:1.4.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BBA57121-8A60-41CB-B767-59A516772DB0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ibm:storwize_unified_v7000:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "969B07CF-DEB1-4463-B361-D6A49642F75A"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}