PT-2014-3090 · Ibm · Ibm Global Retention Policy/Schedule Management+2

Publicado 2014-01-10 · Atualizado 2015-07-28 · CVE-2013-6321

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Atlas eDiscovery Process Management versions 6.0.1.5 and earlier and 6.0.2 IBM Disposal and Governance Management for IT versions 6.0.1.5 and earlier and 6.0.2 IBM Global Retention Policy and Schedule Management versions 6.0.1.5 and earlier and 6.0.2

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Recommendations For IBM Atlas eDiscovery Process Management versions 6.0.1.5 and earlier and 6.0.2, update to a version later than 6.0.2. For IBM Disposal and Governance Management for IT versions 6.0.1.5 and earlier and 6.0.2, update to a version later than 6.0.2. For IBM Global Retention Policy and Schedule Management versions 6.0.1.5 and earlier and 6.0.2, update to a version later than 6.0.2.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2013-6321

Produtos afetados

Ibm Atlas Ediscovery Process Management

Ibm Disposal/Governance Management For It

Ibm Global Retention Policy/Schedule Management

Referências · 4

• http://ibm.com/connections/blogs/PSIRT/entry/security_bulletin_atlas_suite_atlas_policy_suite_sql_injection_vulnerability_cve_2013_6321_and_access_control_vulnerability_cve_2013_6334 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-6321 · Nota de Segurança
• http://osvdb.org/101856 · Nota
• http://securityfocus.com/bid/64749 · Nota