IBM Storage Virtualize versions 8.4, 8.5, 8.6, and 8.7 may allow an authenticated user to escalate their privileges during an SSH session due to improper authorization checks. This vulnerability could lead to unauthorized access to sensitive resources, posing a significant security risk. Users should be aware of the potential for privilege escalation in these versions.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-36120 |
Exploitation
To exploit this vulnerability, an authenticated user can initiate an SSH session and leverage the incorrect authorization checks to gain elevated privileges. This could allow the user to access restricted resources and perform unauthorized actions within the system.
Affected Products
- IBM Storage Virtualize 8.4: Affected by privilege escalation due to authorization flaws.
- IBM Storage Virtualize 8.5: Vulnerable to similar privilege escalation issues.
- IBM Storage Virtualize 8.6: Contains the same security weaknesses as previous versions.
- IBM Storage Virtualize 8.7: Also susceptible to unauthorized privilege escalation.
Mitigation
To mitigate this vulnerability, it is recommended that users upgrade to the latest version of IBM Storage Virtualize that addresses these authorization issues. Additionally, implementing strict access controls and monitoring SSH sessions can help reduce the risk of exploitation.