PT-2013-4799 · Ibm · Infosphere Optim Configuration Manager+3

Publicado 2013-09-25 · Atualizado 2017-08-29 · CVE-2013-4025

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Baixa

Vetor base

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Data Studio Web Console versions 3.x before 3.2 Optim Performance Manager versions 5.x before 5.2 InfoSphere Optim Configuration Manager versions 2.x before 2.2 DB2 Recovery Expert versions 2.x

Description The issue makes it easier for remote attackers to obtain access by leveraging an unattended workstation, due to the lack of an off autocomplete attribute for the login-password field.

Recommendations For IBM Data Studio Web Console versions 3.x before 3.2, update to version 3.2 or later. For Optim Performance Manager versions 5.x before 5.2, update to version 5.2 or later. For InfoSphere Optim Configuration Manager versions 2.x before 2.2, update to version 2.2 or later. For DB2 Recovery Expert versions 2.x, at the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-4025

Produtos afetados

Db2 Recovery Expert

Ibm Data Studio Web Console

Infosphere Optim Configuration Manager

Optim Performance Manager

Referências · 3

• https://exchange.xforce.ibmcloud.com/vulnerabilities/85933 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-4025 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg21650504 · Aviso do Fabricante