CVE-2016-0203
Summary
| CVE | CVE-2016-0203 |
|---|---|
| State | PUBLISHED |
| Assigner | ibm |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-02-08 22:59:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | A vulnerability has been identified in the IBM Cloud Orchestrator task API. The task API might allow an authenticated user to view background information associated with actions performed on virtual machines in projects where the user belongs to. |
Risk And Classification
Primary CVSS: v3.0 5.5 MEDIUM from [email protected]
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-200 | Obtain Information
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 5.5 | MEDIUM | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 2.0 | [email protected] | Primary | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
CVSS v3.0 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:L/AC:L/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ibm | Cloud Orchestrator | 2.4 | All | All | All |
| Application | Ibm | Cloud Orchestrator | 2.4.0.1 | All | All | All |
| Application | Ibm | Cloud Orchestrator | 2.4.0.2 | All | All | All |
| Application | Ibm | Cloud Orchestrator | 2.4.0.3 | All | All | All |
| Application | Ibm | Cloud Orchestrator | 2.5 | All | All | All |
| Application | Ibm | Cloud Orchestrator | 2.5.01 | All | All | All |
| Application | Ibm | Smartcloud Orchestrator | 2.3 | All | All | All |
| Application | Ibm | Smartcloud Orchestrator | 2.3.0.1 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | IBM Corporation | Cloud Orchestrator | affected 2.2 | Not specified |
| CNA | IBM Corporation | Cloud Orchestrator | affected 2.2.0.1 | Not specified |
| CNA | IBM Corporation | Cloud Orchestrator | affected 2.3 | Not specified |
| CNA | IBM Corporation | Cloud Orchestrator | affected 2.4 | Not specified |
| CNA | IBM Corporation | Cloud Orchestrator | affected 2.3.0.1 | Not specified |
| CNA | IBM Corporation | Cloud Orchestrator | affected 2.4.0.1 | Not specified |
| CNA | IBM Corporation | Cloud Orchestrator | affected 2.4.0.2 | Not specified |
| CNA | IBM Corporation | Cloud Orchestrator | affected 2.5 | Not specified |
| CNA | IBM Corporation | Cloud Orchestrator | affected 2.5.0.1 | Not specified |
| CNA | IBM Corporation | Cloud Orchestrator | affected 2.4.0.3 | Not specified |
| CNA | IBM Corporation | Cloud Orchestrator | affected 2.5.0.2 | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| IBM Security Bulletin: Vulnerabilities in IBM Cloud Orchestrator (CVE-2016-0203, CVE-2015-7494) - United States | af854a3a-2127-422b-91ae-364da2661108 | www.ibm.com | Patch, Vendor Advisory |
| Multiple IBM Products CVE-2016-0203 Local Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.