Vulnerability · Published Oct 6, 2023 · Assigned by ibm
CVE-2023-35897IBM Spectrum Protect code execution
High 8.4
In plain English
A high-severity code injection in Storage Protect Client from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)8.4High
Exploit odds (30 days)0.2%top 84.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
IBM Spectrum Protect Client and IBM Storage Protect for Virtual Environments 8.1.0.0 through 8.1.19.0 could allow a local user to execute arbitrary code on the system using a specially crafted file, caused by a DLL hijacking flaw. IBM X-Force ID: 259246.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| IBM | Storage Protect Client | 8.1.0.0 – through 8.1.19.0 |
| IBM | Storage Protect for Virtual Environments | 8.1.0.0 – through 8.1.19.0 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H