IBM Storage Defender Resiliency Service Denial-of-Service Vulnerability

The IBM Storage Defender Resiliency Service is a software component designed to provide resiliency and disaster recovery capabilities for IBM storage systems. However, it has been found that this software can disclose sensitive user credentials in log files, potentially leading to unauthorized access to sensitive data.

Affected versions: 2.0.18 If you don't recognise this software, you're probably not affected.

To fix this vulnerability, you can upgrade to a patched version of IBM Storage Defender Resiliency Service. Unfortunately, there is no public patch link available in the vendor advisory.

Immediate mitigations include:

• Restrict network access to your IBM Storage Defender Resiliency Service instance (firewall it from the public internet)
• Audit admin account activity for suspicious access patterns
• Monitor for unauthorized token creation

• Vendor Advisory