CVE-2023-43040

IBM Spectrum Fusion HCI improper access control

IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.

Affected

IBM · Spectrum Fusion HCI

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 IBM

6.5 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L

EPSS

3.06% chance of exploitation in the next 30 days, 87th percentile

Published

2024-05-13

Updated

2025-11-04

Proof-of-concept exploits (1)

• riza/CVE-2023-430400★ · 2024-07-29

Security advisories

• https://exchange.xforce.ibmcloud.com/vulnerabilities/266807
• https://www.ibm.com/support/pages/node/7151040

References

• CVE Record
• NVD entry