A vulnerability, which was classified as critical, was found in IBM Storage Scale Container Native Storage Access up to 5.1.7.0 (Virtualization Software). This affects an unknown code of the component Container Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on integrity. The summary by CVE is:

IBM Storage Scale Container Native Storage Access 5.1.2.1 -through 5.1.7.0 could allow an attacker to initiate connections to containers from external networks. IBM X-Force ID: 237812.

The weakness was published 02/17/2024. It is possible to read the advisory at ibm.com. This vulnerability is uniquely identified as CVE-2022-41738 since 09/28/2022. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 02/17/2024). It is expected to see the exploit prices for this product increasing in the near future.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at X-Force (237812). Similar entry is available at VDB-254057.

Productinfo

Type

• Virtualization Software

Vendor

• IBM

Name

• Storage Scale Container Native Storage Access

Version

• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5
• 5.1.6
• 5.1.7

License

• commercial

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion