CVE-2023-43040 IBM Spectrum Fusion HCI improper access control

Medium 6.5 Published 13 May 2024 Updated 4 Nov 2025

Attackers can perform unauthorized actions in Ceph RGW due to improper bucket access controls in IBM Spectrum Fusion HCI.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-43040?

CVE-2023-43040 is a medium-severity missing authorization vulnerability in IBM Spectrum Fusion HCI, published on 13 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM Spectrum Fusion HCI 2.5.2 through 2.7.2 could allow an attacker to perform unauthorized actions in RGW for Ceph due to improper bucket access. IBM X-Force ID: 266807.

Weakness: CWE-1220

Which versions are affected by CVE-2023-43040?

It affects 1 product.

Products include Ibm Storage Fusion Hci.

How do I fix CVE-2023-43040?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-43040 being exploited?

There is no known exploitation of CVE-2023-43040 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

CVE-2023-50948 IBM Storage Fusion HCI information disclosure Medium 6.5

Sources

Also known as AZL-40646, DEBIAN-CVE-2023-43040, GHSA-fwhj-j6cr-5qw4, OESA-2023-1761, UBUNTU-CVE-2023-43040, USN-6613-1.