IBM Tivoli Application Dependency Discovery Manager Web UI Portal Multiple Security Vulnerabilities
BID:57878
Info
IBM Tivoli Application Dependency Discovery Manager Web UI Portal Multiple Security Vulnerabilities
| Bugtraq ID: | 57878 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 08 2013 12:00AM |
| Updated: | Feb 08 2013 12:00AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: |
IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.0 IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.2 IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.1.0 |
| Not Vulnerable: | |
Discussion
IBM Tivoli Application Dependency Discovery Manager Web UI Portal Multiple Security Vulnerabilities
IBM Tivoli Application Dependency Discovery Manager is prone to multiple security vulnerabilities, including:
1. A cross-site scripting vulnerability
2. A URI-redirection vulnerability
3. A cross-site request-forgery vulnerability
4. A session-fixation vulnerability
Attackers can exploit these issues to execute arbitrary script or HTML code, steal cookie-based authentication credentials, conduct phishing attacks, perform unauthorized actions, or hijack an arbitrary session and gain unauthorized access to the affected application. Other attacks may also be possible.
IBM Tivoli Application Dependency Discovery Manager versions prior to 7.2.1-TIV-ITADDM-FP0004 are vulnerable.
IBM Tivoli Application Dependency Discovery Manager is prone to multiple security vulnerabilities, including:
1. A cross-site scripting vulnerability
2. A URI-redirection vulnerability
3. A cross-site request-forgery vulnerability
4. A session-fixation vulnerability
Attackers can exploit these issues to execute arbitrary script or HTML code, steal cookie-based authentication credentials, conduct phishing attacks, perform unauthorized actions, or hijack an arbitrary session and gain unauthorized access to the affected application. Other attacks may also be possible.
IBM Tivoli Application Dependency Discovery Manager versions prior to 7.2.1-TIV-ITADDM-FP0004 are vulnerable.
Exploit / POC
IBM Tivoli Application Dependency Discovery Manager Web UI Portal Multiple Security Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI or visit a malicious website.
To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI or visit a malicious website.
Solution / Fix
IBM Tivoli Application Dependency Discovery Manager Web UI Portal Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
Solution:
Updates are available. Please see the references for more information.
References
IBM Tivoli Application Dependency Discovery Manager Web UI Portal Multiple Security Vulnerabilities
References:
References:
- IBM Homepage (IBM)