Read the docs
TI-2023-23059 Aliases CVE-2023-43040GHSA-fwhj-j6cr-5qw4

IBM Spectrum Fusion HCI improper access control

Priority MEDIUM 48CWE-1220Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 4 fixed, 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat.

Summary

IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03063 87th percentileScored 2026-11-07
Fix Partial Red Hat: 2 advisoriesRed Hat: 4 fixed, 4 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
IBMSpectrum Fusion HCI2.5.2 – 2.7.2—No fix listedCNA
  • Spectrum Fusion HCI VendorIBM Affected 2.5.2 – 2.7.2 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:ibm:storage_fusion_hci:*:*:*:*:*:*:*:*2.5.2 to before 2.8.0VulnerableIBM
  • cpe:2.3:a:ibm:storage_fusion_hci:*:*:*:*:*:*:*:* Versions 2.5.2 to before 2.8.0 Vulnerable ·IBM

Remediation

Red Hat 2 advisories

  • RHSA-2024:0745 Released 2024-02-08 · Red Hat rating Moderate
    Red Hat Ceph Storage 5.3 Security update
    • Red Hat Ceph Storage 5.3 MON ceph-2:16.2.10-248.el8cp, ceph-base-2:16.2.10-248.el8cp, ceph-common-2:16.2.10-248.el8cp +30
    • Red Hat Ceph Storage 5.3 OSD ceph-2:16.2.10-248.el8cp, ceph-base-2:16.2.10-248.el8cp, ceph-common-2:16.2.10-248.el8cp +20
    • Red Hat Ceph Storage 5.3 Tools ceph-2:16.2.10-248.el8cp, ceph-2:16.2.10-248.el9cp, ceph-ansible-6.0.28.7-1.el8cp +47
  • RHSA-2023:5693 Released 2023-10-12 · Red Hat rating Moderate
    Red Hat Ceph Storage 6.1 security, enhancement, and bug fix update
    • Red Hat Ceph Storage 6.1 Tools ceph-2:17.2.6-148.el9cp, ceph-base-2:17.2.6-148.el9cp, ceph-common-2:17.2.6-148.el9cp +25

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ceph Storage 3AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 4AffectedNo fix planned: Out of support scope
Red Hat Openshift Container Storage 4AffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Ceph Storage 5.3 MONFixed RHSA-2024:0745
Red Hat Ceph Storage 5.3 OSDFixed RHSA-2024:0745
Red Hat Ceph Storage 5.3 ToolsFixed RHSA-2024:0745
Red Hat Ceph Storage 6.1 ToolsFixed RHSA-2023:5693
Not affected: 1 product
  • Red Hat Ceph Storage 6.1 Tools

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-43040
  2. 2026-10-03 Alias added: GHSA-fwhj-j6cr-5qw4

References

Advisory 1

  • TI-2025-24757 IBM Fusion insecure default configuration CVSS 3.1CRITICAL 9.8
  • TI-2023-27841 IBM Storage Fusion HCI information disclosure CVSS 3.1CRITICAL 9.8
  • TI-2024-14902 IBM Fusion improper communication restriction CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences