CVE-2024-31891 is a local privilege escalation vulnerability affecting IBM Storage Scale GUI versions 5.1.9.0 through 5.1.9.6 and 5.2.0.0 through 5.2.1.1. An attacker with command line access as the 'scalemgmt' user can exploit this to gain root privileges on the host operating system. Rated with a CVSS score of 7.8 (HIGH), this vulnerability has a low attack complexity and requires local access, but successful exploitation leads to complete compromise of confidentiality, integrity, and availability. Its EPSS score is very low, indicating a low probability of exploitation in the wild. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. The vulnerability has received minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 5.1.9.0, < 5.1.9.7CPE matchmatch criteria | cpe:2.3:a:ibm:storage_scale:*:*:*:*:*:*:*:* | ||
>= 5.2.0.0, < 5.2.2.0CPE matchmatch criteria | cpe:2.3:a:ibm:storage_scale:*:*:*:*:*:*:*:* | ||
>= 5.1.9.0, <= 5.1.9.6CPE match | cpe:2.3:a:ibm:storage_scale:*:*:*:*:*:*:*:* | ||
>= 5.2.0.0, <= 5.2.1.1CPE match | cpe:2.3:a:ibm:storage_scale:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.