CVE-2023-49877

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote authenticated user to obtain sensitive information, caused by improper filtering of URLs. By submitting a specially crafted HTTP GET request, an attacker could exploit this vulnerability to view application source code, system configuration information, or other sensitive data related to the Management Interface. IBM X-Force ID: 272651.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Dec 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-498784.3IBM System Storage Virtualization Engine TS7700 3957-VEC, 3948-VED and 3957-VEC could allow a remote attacker to obtain sensitive informatio CVE-2023-49889.8A vulnerability, which was classified as problematic, was found in Bettershop LaikeTui. This affects an unknown part of the file index.php?m CVE-2023-498807.5In the Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services 3.2.4 the sending address and the mes CVE-2023-498818.8IBM Transformation Extender Advanced 10.0.1 does not invalidate session after logout which could allow an authenticated user to impersonat CVE-2023-498837.5IBM Transformation Extender Advanced 10.0.1 does not require that users should have strong passwords by default, which makes it easier CVE-2023-498869.8IBM Standards Processing Engine 10.0.1.10 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe java de CVE-2023-498978.8An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. I CVE-2023-498987.2In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation param CVE-2023-498999.8An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communicati CVE-2023-49907.5Directory traversal vulnerability in MCL-Net versions prior to 4.6 Update Package (P01) may allow attackers to read arbitrary files.CVE-2023-499009.8An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter comm CVE-2023-499068.8A stack-based buffer overflow vulnerability exists in the web interface Radio Scheduling functionality of Tp-Link AC1350 Wireless MU-MIMO Gi