CVE-2023-47148 is a medium severity flaw in IBM Storage Protect Plus Server, scored 5.3. Versions 10.1.0 through 10.1.15.2 have an Admin Console endpoint that lets a remote attacker obtain sensitive information. IBM lists 10.1.15.3 as the fixing level, so upgrade and limit console access.
What's affected
IBM's bulletin lists IBM Spectrum Protect Plus, now named Storage Protect Plus, versions 10.1.0 through 10.1.15.2 as affected, with 10.1.15.3 as the fixing level on Linux. The record agrees on the 10.1.0 through 10.1.15.2 range.
The bulletin is a broader one, covering several issues in Go and in the Linux kernel alongside this CVE. Upgrading to the fixing level addresses the full set listed. The affected product line in the bulletin names vSnap 10.1.
The weakness is described as improper validation of unsecured endpoints in the Admin Console, which could be used in further attacks. The score is medium, 5.3, with a network vector, no privileges and a low confidentiality impact. IBM first published the bulletin on 22 January 2024 and lists workarounds and mitigations as none.
The NVD record was published on 2024-02-02, scores 5.3 (Medium), and carries the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. Weakness class: CWE-862.
How to check if you're exposed
Find the version of the Storage Protect Plus server.
- Sign in to the administrative console and read the version in the product information.
- Compare it against the 10.1.0 to 10.1.15.2 range.
- Check which networks can reach the Admin Console, and whether it is open beyond the backup administration team.
Backup consoles belong on management networks only.
What to do now
- Confirm your server version.
- Upgrade to 10.1.15.3 or later, following the instructions linked from IBM's bulletin.
- Restrict the Admin Console to administrators on a management network.
- Review console access logs for requests from unexpected sources.
- Check the other CVEs listed in the same bulletin and confirm they are closed.
Why it matters
The class is CWE-862, missing authorization. An endpoint answers without checking whether the caller has rights, so it can return information that should be limited to administrators.
The data is low in sensitivity by the score, but information about a backup system helps an attacker plan. Backup platforms hold copies of everything, so they deserve careful network limits. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
A medium score does not mean low priority for backup infrastructure, particularly when the fix is a single upgrade.
There is also a reason to look at the whole bulletin. IBM groups this CVE with several Go and Linux kernel issues, and the same upgrade covers them. Reading only the headline CVE would leave you with a partial picture of what the new level fixes, so record every identifier in the bulletin in your change ticket.
Quick check
Which version fixes it?
IBM lists 10.1.15.3 as the fixing level for 10.1.0 through 10.1.15.2.
Sources
Last reviewed: 19 October 2026.
