PT-2012-2056 · Sybase · Sybase M-Business Anywhere

Publicado 2012-02-08 · Atualizado 2012-02-09 · CVE-2011-5078

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sybase M-Business Anywhere versions 6.7 through 6.7 before ESD# 3 Sybase M-Business Anywhere versions 7.0 through 7.0 before ESD# 7

Description The web administration interface in the server does not require admin authentication for certain scripts, allowing remote authenticated users to list or delete user accounts, modify passwords, or read log files via HTTP requests.

Recommendations For Sybase M-Business Anywhere version 6.7, update to ESD# 3 or later. For Sybase M-Business Anywhere version 7.0, update to ESD# 7 or later.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2011-5078

Produtos afetados

Sybase M-Business Anywhere

Referências · 3

• http://sybase.com/detail?id=1095200 · Aviso do Fabricante
• http://verisigninc.com/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=952 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-5078 · Nota de Segurança