Vulnerability · Published Oct 21, 2021 · Assigned by ibm
CVE-2021-29873
High 8.8
In plain English
A high-severity security flaw in FlashSystem 900 from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 75% of all known vulnerabilities).
Severity (CVSS 3.0)8.8High
Exploit odds (30 days)1.5%top 25.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted shell escape vulnerability. IBM X-Force ID: 206229.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IBM | FlashSystem 900 | 1.6.1.41.5.2.10 |
| IBM | FlashSystem V9000 | 7.88.4 |
| IBM | Storwize V3500 | 7.88.4 |
| IBM | Storwize V5000 | 7.88.4 |
| IBM | Storwize V5100 | 8.47.8 |
| IBM | FlashSystem 9100 Family | 8.47.8 |
| IBM | Storwize V3700 | 7.88.4 |
| IBM | SAN Volume Controller | 7.88.4 |
| IBM | Storwize V7000 | 8.47.8 |
| IBM | Spectrum Virtualize Software | 7.88.4 |
| IBM | Spectrum Virtualize for Public Cloud | 7.88.4 |
References
- https://www.ibm.com/support/pages/node/6497111 x_refsource_CONFIRM
- https://www.ibm.com/support/pages/node/6507091 x_refsource_CONFIRM
- ibm-storwize-cve202129873-priv-escalation (206229) vdb-entry, x_refsource_XF