IBM Storage Protect for Virtual Environments up to 8.1.22.0 Request improper authorization

Summaryinfo

A vulnerability categorized as critical has been discovered in IBM Storage Protect for Virtual Environments up to 8.1.22.0. This issue affects some unknown processing of the component Request Handler. Such manipulation leads to improper authorization. This vulnerability is documented as CVE-2024-38329. The attack can be executed remotely. There is not any exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in IBM Storage Protect for Virtual Environments up to 8.1.22.0. Affected by this issue is an unknown functionality of the component Request Handler. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity, and availability. CVE summarizes:

IBM Storage Protect for Virtual Environments: Data Protection for VMware 8.1.0.0 through 8.1.22.0 could allow a remote authenticated attacker to bypass security restrictions, caused by improper validation of user permission. By sending a specially crafted request, an attacker could exploit this vulnerability to change its settings, trigger backups, restore backups, and also delete all previous backups via log rotation. IBM X-Force ID: 294994.

The advisory is shared for download at ibm.com. This vulnerability is handled as CVE-2024-38329 since 06/13/2024. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/03/2024). The MITRE ATT&CK project declares the attack technique as T1548.002.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at X-Force (294994). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• IBM

Name

• Storage Protect for Virtual Environments

Version

• 8.1.0
• 8.1.1
• 8.1.2
• 8.1.3
• 8.1.4
• 8.1.5
• 8.1.6
• 8.1.7
• 8.1.8
• 8.1.9
• 8.1.10
• 8.1.11
• 8.1.12
• 8.1.13
• 8.1.14
• 8.1.15
• 8.1.16
• 8.1.17
• 8.1.18
• 8.1.19
• 8.1.20
• 8.1.21
• 8.1.22.0

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion