IBM Storage Defender Sensitive Information Disclosure Vulnerability via Insecure Network Channel

A vulnerability in IBM Storage Defender versions 2.0.0 to 2.0.7 has been identified, allowing remote attackers to intercept sensitive information through man-in-the-middle techniques. This issue arises from the defender-sensor-cmd CLI sending network requests over an insecure channel.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive information.

Remediation

Users are advised to upgrade to IBM Storage Defender version 2.0.8 or newer, where the Connection Manager includes the necessary fixes. Instructions for upgrading can be found in the IBM Storage Defender Resiliency Service documentation.