Multiple IBM Products CVE-2013-6321 Unspecified SQL Injection Vulnerabilitiy
BID:64749
Info
Multiple IBM Products CVE-2013-6321 Unspecified SQL Injection Vulnerabilitiy
| Bugtraq ID: | 64749 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-6321 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 07 2014 12:00AM |
| Updated: | Jan 07 2014 12:00AM |
| Credit: | Reported by vendor. |
| Vulnerable: |
IBM Global Retention Policy and Schedule Management 6.0.2 IBM Global Retention Policy and Schedule Management 6.0.1.5 IBM Global Retention Policy and Schedule Management 6.0.1.4 IBM Disposal and Governance Management for IT 6.0.2 IBM Disposal and Governance Management for IT 6.0.1.5 IBM Disposal and Governance Management for IT 6.0.1.4 IBM Atlas eDiscovery Process Management 6.0.2 IBM Atlas eDiscovery Process Management 6.0.1.5 IBM Atlas eDiscovery Process Management 6.0.1.4 |
| Not Vulnerable: | |
Discussion
Multiple IBM Products CVE-2013-6321 Unspecified SQL Injection Vulnerabilitiy
Multiple IBM Products are prone to an unspecified SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database
The following products are vulnerable:
IBM Atlas eDiscovery Process Management
IBM Disposal and Governance Management for IT
IBM Global Retention Policy and Schedule Management
Multiple IBM Products are prone to an unspecified SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.
An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database
The following products are vulnerable:
IBM Atlas eDiscovery Process Management
IBM Disposal and Governance Management for IT
IBM Global Retention Policy and Schedule Management
Exploit / POC
Multiple IBM Products CVE-2013-6321 Unspecified SQL Injection Vulnerabilitiy
Attackers can use a browser to exploit this issue.
Attackers can use a browser to exploit this issue.
Solution / Fix
Multiple IBM Products CVE-2013-6321 Unspecified SQL Injection Vulnerabilitiy
Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.
Solution:
Reportedly the issue is fixed, however Symantec has not confirmed this. Please contact the vendor for more information.
References
Multiple IBM Products CVE-2013-6321 Unspecified SQL Injection Vulnerabilitiy
References:
References: