CVE-2015-7408
Summary
| CVE | CVE-2015-7408 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2016-02-15 02:59:10 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | The server in IBM Spectrum Protect (aka Tivoli Storage Manager) 5.5 and 6.x before 6.3.5.1 and 7.x before 7.1.4 does not properly restrict use of the ASNODENAME option, which allows remote attackers to read or write to backup data by leveraging proxy authority. |
Risk And Classification
Primary CVSS: v3.0 3.7 LOW from [email protected]
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Problem Types: CWE-264 | n/a
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 3.7 | LOW | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| 2.0 | [email protected] | Primary | 2.6 | AV:N/AC:H/Au:N/C:P/I:N/A:N |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
LowIntegrity
NoneAvailability
NoneCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:H/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ibm | Tivoli Storage Manager | 5.5.0.0 | All | All | All |
| Application | Ibm | Tivoli Storage Manager | 6.1.0.0 | All | All | All |
| Application | Ibm | Tivoli Storage Manager | 6.2.0.0 | All | All | All |
| Application | Ibm | Tivoli Storage Manager | 6.3.3.0 | All | All | All |
| Application | Ibm | Tivoli Storage Manager | 6.3.4.0 | All | All | All |
| Application | Ibm | Tivoli Storage Manager | 6.3.5.0 | All | All | All |
| Application | Ibm | Tivoli Storage Manager | 7.1.0.0 | All | All | All |
| Application | Ibm | Tivoli Storage Manager | 7.1.0.1 | All | All | All |
| Application | Ibm | Tivoli Storage Manager | 7.1.0.2 | All | All | All |
| Application | Ibm | Tivoli Storage Manager | 7.1.0.3 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Security Bulletin: IBM Tivoli Storage Manager ASNODENAME Vulnerability (CVE-2015-7408) | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Vendor Advisory |
| IT13609: UNAUTHORIZED TIVOLI STORAGE MANAGER CLIENT SESSIONS USING ASNODENAME OPTION MAY RUN AS AUTHORIZED SESSIONS. | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.