CVE-2023-43029
Ibm Storage Virtualize Plugin For Vsphere 1.0.0 … 1.1.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:NSummary
CVE-2023-43029 is a medium-severity Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) vulnerability in Ibm Storage Virtualize Plugin For Vsphere. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SC-28 (Protection of Information at Rest) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2023-43029 is a vulnerability in IBM Storage Virtualize vSphere Remote Plug-in versions 1.0 and 1.1 that could allow a remote user to obtain sensitive credential information after deployment. Classified under CWE-526, it carries a CVSS v3.1 base score of 6.8 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N), indicating medium severity with high confidentiality impact and changed scope.
The vulnerability can be exploited by a remote attacker who possesses high privileges (PR:H). Exploitation requires low attack complexity over the network with no user interaction, enabling the attacker to access sensitive credential information without impacting integrity or availability.
IBM has published a security advisory detailing the issue at https://www.ibm.com/support/pages/node/7228722.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-47450
Vulnerability Data
IBM Storage Virtualize vSphere Remote Plug-in 1.0 and 1.1 could allow a remote user to obtain sensitive credential information after deployment.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates use of cryptography to protect sensitive information, preventing its unencrypted storage in environment variables.
Requires confidentiality protection (typically encryption) for information at rest, directly stopping cleartext storage of sensitive data in environment variables.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Cryptography control directly addresses the lack of encryption for sensitive data stored in environment variables.
Classification drives decisions on what must be protected, indirectly discouraging cleartext storage of sensitive data.
Authentication secrets are a common type of sensitive information; the control requires protecting them, which this weakness violates.
Requires secure deletion of sensitive information, which would prevent leaving it in environment variables.
Data masking techniques can be applied to avoid storing sensitive values in cleartext environment variables.
DLP policies can detect and block the placement of sensitive data into environment variables.