CVE-2023-47700 IBM Storage Virtualize improper certificate validation

What is CVE-2023-47700?

CVE-2023-47700 is a medium-severity vulnerability in IBM Storage Virtualize, published on 7 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

IBM SAN Volume Controller, IBM Storwize, IBM FlashSystem and IBM Storage Virtualize 8.6 products could allow a remote attacker to spoof a trusted system that would not be correctly validated by the Storwize server. This could lead to a user connecting to a malicious host, believing that it was a trusted system and deceived into accepting spoofed data. IBM X-Force ID: 271016.

Weakness: CWE-295

Which versions are affected by CVE-2023-47700?

It affects 1 product.

Products include Ibm Storage Virtualize.

How do I fix CVE-2023-47700?

No fix has been published for CVE-2023-47700 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-47700 being exploited?

There is no known exploitation of CVE-2023-47700 in the wild and no public exploit code.

Other vulnerabilities in IBM Storage Virtualize

• CVE-2025-0159 IBM FlashSystem authentication bypass Critical 9.1
• CVE-2025-36120 IBM Storage Virtualize privilege escalation High 8.8
• CVE-2025-0160 IBM FlashSystem code execution High 8.1
• CVE-2025-36118 IBM Storage Virtualize Information Disclosure High 7.5
• CVE-2023-43042 IBM Storage Virtualize information disclosure High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qxf6-787j-fc5g.