« Volver al listado

CVE-2025-36398

Estado: AnalizadaMedia (5.4)—

IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

IBM — Ds8900f FirmwareIBM — Ds8a00 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-36398",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-36398",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-20T16:16:56.030182Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "psirt@us.ibm.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:o:ibm:system_storage_ds8A00:10.1.3.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:ibm:system_storage_ds8A00:10.11.35.0:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "DS8A00 (R10.0 - R10.1)",
          "versions": [
            {
              "status": "affected",
              "version": "10.1.3.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.11.35.0"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:o:ibm:system_storage_ds8900f:89.40.83.0:*:*:*:*:*:*:*",
            "cpe:2.3:o:ibm:system_storage_ds8900f:89.44.25.0:*:*:*:*:*:*:*"
          ],
          "vendor": "IBM",
          "product": "DS8900F (R9.4)",
          "versions": [
            {
              "status": "affected",
              "version": "89.40.83.0",
              "versionType": "semver",
              "lessThanOrEqual": "89.44.25.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-08-19T22:16:36.640",
  "references": [
    {
      "url": "https://www.ibm.com/support/pages/node/7284322",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@us.ibm.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-73"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM System Storage DS8A00 10.1.3.0 through 10.11.35.0 and IBM DS8900F 89.40.83.0 through 89.44.25.0 could allow an authenticated user to read or modify another user's command history due to an externally controlled filename."
    },
    {
      "lang": "es",
      "value": "IBM System Storage DS8A00 10.1.3.0 hasta 10.11.35.0 y IBM DS8900F 89.40.83.0 hasta 89.44.25.0 podrían permitir a un usuario autenticado leer o modificar el historial de comandos de otro usuario debido a un nombre de archivo controlado externamente."
    }
  ],
  "lastModified": "2026-09-29T10:10:00.263",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:ds8900f_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "713AB91F-E2EE-4226-937C-9A4FC6814AA4",
              "versionEndIncluding": "89.44.25.0",
              "versionStartIncluding": "89.40.83.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:ds8900f:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "42263F4C-C8BB-4A78-AB6A-1458546961B8"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:ibm:ds8a00_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "589799B5-0AFE-49BF-8616-61DA494E1AD0",
              "versionEndIncluding": "10.11.35.0",
              "versionStartIncluding": "10.1.3.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ibm:ds8a00:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "16A7298D-DDA7-49D5-97D2-2C3A064A7C17"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}