High severity · published Sep 26, 2018
CVE-2018-1545
IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive…
7.5
CVSS
1%
EPSS
No
On KEV
Description
IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 142649.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
Spectrum Protect Client · Ibm
7.1.0.0 through 7.1.8.2; 8.1.0.0 through 8.1.4.1; 8.1.0.0 through 8.1.4.2 · source: NVD
SP
Spectrum Protect For Virtual Environments · Ibm
7.1.0.0 through 7.1.8.0; 7.1.0.0 through 7.1.8.2; 8.1.0.0 through 8.1.4.0; 8.1.0.0 through 8.1.4.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1545
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1545
Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=ibm10718013
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/142649
More from Spectrum Protect Client
7.8
CVE-2021-29672
IBM Spectrum Protect Client 8.1.0.0-8 through 1.11.0 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking when processing the current locale settings
7.5
CVE-2022-22474
IBM Spectrum Protect 8.1.0.0 through 8.1.14.0 dsmcad, dsmc, and dsmcsvc processes incorrectly handle certain read operations on TCP/IP sockets
7.5
CVE-2020-4494
IBM Spectrum Protect Client 8.1.7.0 through 8.1.9.1 (Linux and Windows), 8.1.9.0 trough 8.1.9.1 (AIX) and IBM Spectrum Protect for Space Management 8.1.7.0 through 8.1.9.1…
7.5
CVE-2018-1785
IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt sensitive information
5.5
CVE-2022-22478
IBM Spectrum Protect Client 8.1.0.0 through 8.1.14.0 stores user credentials in plain clear text which can be read by a local user