Multiple IBM Products Multiple Security Vulnerabilities
BID:62685
CVE-2013-3323 |Info
Multiple IBM Products Multiple Security Vulnerabilities
| Bugtraq ID: | 62685 |
| Class: | Unknown |
| CVE: |
CVE-2012-3323 CVE-2013-0451 CVE-2013-3047 CVE-2013-3048 CVE-2013-3049 CVE-2013-3323 CVE-2013-3971 CVE-2013-3973 CVE-2013-4013 CVE-2013-4014 CVE-2013-4017 CVE-2013-4018 CVE-2013-4019 CVE-2013-4020 CVE-2013-4021 CVE-2013-4027 CVE-2013-5380 CVE-2013-5381 CVE-2013-5382 CVE-2013-5383 CVE-2013-5395 |
| Remote: | Yes |
| Local: | Yes |
| Published: | Sep 25 2013 12:00AM |
| Updated: | May 22 2014 11:24AM |
| Credit: | IBM |
| Vulnerable: |
IBM Tivoli Service Request Manager 7.2 IBM Tivoli Service Request Manager 7.1 IBM Tivoli Asset Management for IT 7.2 IBM Tivoli Asset Management for IT 7.1 IBM Tivoli Asset Management for IT 6.2 IBM Maximo Service Desk 6.2 IBM Maximo Asset Management Essentials 7.5 IBM Maximo Asset Management Essentials 7.1 IBM Maximo Asset Management Essentials 6.2 IBM Maximo Asset Management 7.5 IBM Maximo Asset Management 7.1 IBM Maximo Asset Management 6.2 IBM Change and Configuration Management Database 7.2 IBM Change and Configuration Management Database 7.1 |
| Not Vulnerable: | |
Discussion
Multiple IBM Products Multiple Security Vulnerabilities
Multiple IBM products are prone to the multiple security vulnerabilities including:
1. Multiple cross-site scripting vulnerabilities
2. Multiple information-disclosure vulnerabilities
3. Multiple SQL-injection issues
4. Multiple security-bypass vulnerabilities
5. Multiple privilege-escalation issues
6. A file-include vulnerability
An attacker can exploit these issues to steal cookie-based authentication credentials, compromise the application, access or modify data, execute arbitrary files within the context of the web server, exploit vulnerabilities in the underlying database, obtain potentially sensitive information, gain escalated privileges, bypass security restrictions, and perform unauthorized actions; other attacks may also be possible.
The following products are affected:
Maximo Asset Management 7.5, 7.1, and 6.2
Maximo Asset Management Essentials 7.5, 7.1, and 6.2
SmartCloud Control Desk 7.5
Tivoli Asset Management for IT 7.2, 7.1, and 6.2
Tivoli Service Request Manager 7.2 and 7.1
Maximo Service Desk 6.2
Change and Configuration Management Database 7.2 and 7.1
Multiple IBM products are prone to the multiple security vulnerabilities including:
1. Multiple cross-site scripting vulnerabilities
2. Multiple information-disclosure vulnerabilities
3. Multiple SQL-injection issues
4. Multiple security-bypass vulnerabilities
5. Multiple privilege-escalation issues
6. A file-include vulnerability
An attacker can exploit these issues to steal cookie-based authentication credentials, compromise the application, access or modify data, execute arbitrary files within the context of the web server, exploit vulnerabilities in the underlying database, obtain potentially sensitive information, gain escalated privileges, bypass security restrictions, and perform unauthorized actions; other attacks may also be possible.
The following products are affected:
Maximo Asset Management 7.5, 7.1, and 6.2
Maximo Asset Management Essentials 7.5, 7.1, and 6.2
SmartCloud Control Desk 7.5
Tivoli Asset Management for IT 7.2, 7.1, and 6.2
Tivoli Service Request Manager 7.2 and 7.1
Maximo Service Desk 6.2
Change and Configuration Management Database 7.2 and 7.1
Exploit / POC
Multiple IBM Products Multiple Security Vulnerabilities
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Multiple IBM Products Multiple Security Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.