IBM Financial Transaction Manager Unspecified Directory Traversal Vulnerabilities
BID:64792
Info
IBM Financial Transaction Manager Unspecified Directory Traversal Vulnerabilities
| Bugtraq ID: | 64792 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 13 2014 12:00AM |
| Updated: | Jan 13 2014 12:00AM |
| Credit: | IBM |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
IBM Financial Transaction Manager Unspecified Directory Traversal Vulnerabilities
IBM Financial Transaction Manager is prone to multiple unspecified directory-traversal vulnerabilities because it fails to properly sanitize user-supplied input.
A remote attacker could exploit these vulnerabilities using directory-traversal characters ('../') to access arbitrary files that contain sensitive information. Information harvested may aid in launching further attacks.
Versions prior to Financial Transaction Manager 2.1.1 are vulnerable.
IBM Financial Transaction Manager is prone to multiple unspecified directory-traversal vulnerabilities because it fails to properly sanitize user-supplied input.
A remote attacker could exploit these vulnerabilities using directory-traversal characters ('../') to access arbitrary files that contain sensitive information. Information harvested may aid in launching further attacks.
Versions prior to Financial Transaction Manager 2.1.1 are vulnerable.
Exploit / POC
IBM Financial Transaction Manager Unspecified Directory Traversal Vulnerabilities
An attacker can use a browser to exploit these issues.
An attacker can use a browser to exploit these issues.
Solution / Fix
IBM Financial Transaction Manager Unspecified Directory Traversal Vulnerabilities
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
IBM Financial Transaction Manager Unspecified Directory Traversal Vulnerabilities
References:
References: