CVE-2023-43029 - Vulnerability Details - OpenCVE

IBM Storage Virtualize vSphere Remote Plug-in 1.0 and 1.1 could allow a remote user to obtain sensitive credential information after deployment.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ibm	Storage Virtualize Vsphere Remote Plugin

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7228722

History

Fri, 21 Mar 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 21 Mar 2025 15:45:00 +0000

Type	Values Removed	Values Added
Description		IBM Storage Virtualize vSphere Remote Plug-in 1.0 and 1.1 could allow a remote user to obtain sensitive credential information after deployment.
Title		IBM Storage Virtualize vSphere Remote Plug-in information disclosure
First Time appeared		Ibm Ibm storage Virtualize Vsphere Remote Plugin
Weaknesses		CWE-526
CPEs		cpe:2.3:a:ibm:storage_virtualize_vsphere_remote_plugin:1.0:::::::* cpe:2.3:a:ibm:storage_virtualize_vsphere_remote_plugin:1.1:::::::*
Vendors & Products		Ibm Ibm storage Virtualize Vsphere Remote Plugin
References		https://www.ibm.com/support/pages/node/7228722
Metrics		cvssV4_0 `{'score': 10, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2025-03-21T15:33:51.807Z

Updated: 2025-03-21T20:24:14.648Z

Reserved: 2023-09-15T01:12:09.120Z

Link: CVE-2023-43029

Vulnrichment

Updated: 2025-03-21T20:24:04.637Z

NVD

Status : Received

Published: 2025-03-21T16:15:17.240

Modified: 2025-03-21T16:15:17.240

Link: CVE-2023-43029

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-43029", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2023-09-15T01:12:09.120Z", "datePublished": "2025-03-21T15:33:51.807Z", "dateUpdated": "2025-03-21T20:24:14.648Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:storage_virtualize_vsphere_remote_plugin:1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_virtualize_vsphere_remote_plugin:1.1:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Storage Virtualize vSphere Remote Plug-in", "vendor": "IBM", "versions": [{"status": "affected", "version": "1.0, 1.1"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Storage Virtualize vSphere Remote Plug-in 1.0 and 1.1 could allow a remote user to obtain sensitive credential information after deployment."}], "value": "IBM Storage Virtualize vSphere Remote Plug-in 1.0 and 1.1 could allow a remote user to obtain sensitive credential information after deployment."}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-526", "description": "CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-03-21T15:33:51.807Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://www.ibm.com/support/pages/node/7228722"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Storage Virtualize vSphere Remote Plug-in information disclosure", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-21T20:23:54.659738Z", "id": "CVE-2023-43029", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-21T20:24:14.648Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-43029", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-21T20:23:54.659738Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-21T20:24:04.637Z"}}], "cna": {"title": "IBM Storage Virtualize vSphere Remote Plug-in information disclosure", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:storage_virtualize_vsphere_remote_plugin:1.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:storage_virtualize_vsphere_remote_plugin:1.1:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Storage Virtualize vSphere Remote Plug-in", "versions": [{"status": "affected", "version": "1.0, 1.1"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.ibm.com/support/pages/node/7228722", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM Storage Virtualize vSphere Remote Plug-in 1.0 and 1.1 could allow a remote user to obtain sensitive credential information after deployment.", "supportingMedia": [{"type": "text/html", "value": "IBM Storage Virtualize vSphere Remote Plug-in 1.0 and 1.1 could allow a remote user to obtain sensitive credential information after deployment.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-526", "description": "CWE-526 Cleartext Storage of Sensitive Information in an Environment Variable"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2025-03-21T15:33:51.807Z"}}}, "cveMetadata": {"cveId": "CVE-2023-43029", "state": "PUBLISHED", "dateUpdated": "2025-03-21T20:24:14.648Z", "dateReserved": "2023-09-15T01:12:09.120Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2025-03-21T15:33:51.807Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}