Information disclosure in IBM Storwize Unified V7000

CVE-2014-3077

IBM SONAS and System Storage Storwize V7000 Unified (aka V7000U) 1.3.x and 1.4.x before 1.4.3.4 store the chkauth password in the audit log, which allows local users to obtain sensitive information by reading this log file.

Vulnerability class: Information Disclosure

EPSS: 0.003 (23.6th percentile) — read the EPSS interpretation.

Affected products

Ibm Storwize_unified_v7000
Ibm Storwize_v7000_unified_software — versions 1.3.0.0, 1.3.2.0, 1.3.2.3
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

psirt@us.ibm.com (x_refsource_CONFIRM, Vendor Advisory)
psirt@us.ibm.com (vdb-entry, x_refsource_XF)