Vulnerability CVE-2011-0494


Published: 2011-01-19   Modified: 2012-02-13

Description:
Directory traversal vulnerability in WebSEAL in IBM Tivoli Access Manager for e-business 5.1 before 5.1.0.39-TIV-AWS-IF0040, 6.0 before 6.0.0.25-TIV-AWS-IF0026, 6.1.0 before 6.1.0.5-TIV-AWS-IF0006, and 6.1.1 before 6.1.1-TIV-AWS-FP0001 has unspecified impact and attack vectors. NOTE: this might overlap CVE-2010-4622.

Type:

CWE-22

(Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))

Vendor: IBM
Product: Tivoli access manager for e-business 
Version:
6.1.1
6.1.0.4
6.1.0.3
6.1.0
6.0.0.23
6.0.0.17
6.0.0
5.1.0.10
5.1

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
5/10
2.9/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None

 References:
http://xforce.iss.net/xforce/xfdb/64737
http://www.vupen.com/english/advisories/2011/0138
http://www.securityfocus.com/bid/45836
http://www-01.ibm.com/support/docview.wss?uid=swg24028861
http://www-01.ibm.com/support/docview.wss?uid=swg24028860
http://www-01.ibm.com/support/docview.wss?uid=swg24028829
http://www-01.ibm.com/support/docview.wss?uid=swg24025790
http://www-01.ibm.com/support/docview.wss?uid=swg21459999
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ91620
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ91619
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ87470
http://www-01.ibm.com/support/docview.wss?uid=swg1IZ87328
http://secunia.com/advisories/42955

Related CVE
CVE-2019-4473
Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 163984.
CVE-2019-4284
IBM Cloud Private 2.1.0 , 3.1.0, 3.1.1, and 3.1.2 could allow a local privileged user to obtain sensitive OIDC token that is printed to log files, which could be used to log in to the system as another user. IBM X-Force ID: 160512.
CVE-2019-4261
IBM WebSphere MQ V7.1, 7.5, IBM MQ V8, IBM MQ V9.0LTS, IBM MQ V9.1 LTS, and IBM MQ V9.1 CD are vulnerable to a denial of service attack caused by specially crafted messages. IBM X-Force ID: 160013.
CVE-2019-4275
IBM Jazz for Service Management 1.1.3, 1.1.3.1, and 1.1.3.2 could allow an unauthorized local user to create unique catalog names that could cause a denial of service. IBM X-Force ID: 160296.
CVE-2019-4165
IBM StoreIQ 7.6.0.0. through 7.6.0.18 could allow a remote attacker to cause a denial of service attack using repeated requests to the server. IBM X-Force ID: 158698.
CVE-2019-4163
IBM StoreIQ 7.6.0.0. through 7.6.0.18 could allow an authenticated user to obtain sensitive information that a privileged user should only be allowed to view. IBM X-Force ID: 158696.
CVE-2019-4456
IBM Daeja ViewONE Professional, Standard & Virtual 5.0.5 and 5.0.6 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume ...
CVE-2019-4285
IBM WebSphere Application Server - Liberty Admin Center could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could send a specially-crafted HTTP request to ...

Copyright 2019, cxsecurity.com

 

Back to Top