CVE-2018-1993 : IBM Spectrum Scale (GPFS) 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache (LROC) is

IBM Spectrum Scale (GPFS) 4.1.1, 4.2.0, 4.2.1, 4.2.2, 4.2.3, and 5.0.0 where the use of Local Read Only Cache (LROC) is enabled may caused read operation on a file to return data from a different file. IBM X-Force ID: 154440.

Published 2019-01-08 16:29:00

Updated 2019-10-09 23:39:29

Source IBM Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2018-1993

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 17 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-1993

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
3.3	LOW	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	1.8	1.4	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None
4.0	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	2.5	1.4	IBM Corporation
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

References for CVE-2018-1993

https://exchange.xforce.ibmcloud.com/vulnerabilities/154440

IBM Spectrum Scale information disclosure CVE-2018-1993 Vulnerability Report
VDB Entry;Vendor Advisory
http://www.securityfocus.com/bid/106485

IBM Spectrum Scale CVE-2018-1993 Local Information Disclosure Vulnerability
Third Party Advisory;VDB Entry
https://www.ibm.com/support/docview.wss?uid=ibm10793719

IBM Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale where the use of Local Read Only Cache (LROC) may result in directory corruption and undetected data corruption in regu
Patch;Vendor Advisory

Products affected by CVE-2018-1993

IBM » Spectrum Scale
Versions from including (>=) 4.1.1.0 and up to, including, (<=) 4.1.1.21
cpe:2.3:a:ibm:spectrum_scale:*:*:*:*:*:*:*:*
Matching versions
IBM » Spectrum Scale
Versions from including (>=) 4.2.0.0 and up to, including, (<=) 4.2.3.11
cpe:2.3:a:ibm:spectrum_scale:*:*:*:*:*:*:*:*
Matching versions
IBM » Spectrum Scale
Versions from including (>=) 5.0.0.0 and up to, including, (<=) 5.0.2.0
cpe:2.3:a:ibm:spectrum_scale:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2018-1993

Exploit prediction scoring system (EPSS) score for CVE-2018-1993

CVSS scores for CVE-2018-1993

CWE ids for CVE-2018-1993

References for CVE-2018-1993

Products affected by CVE-2018-1993