PT-2014-3173 · Ibm · Ibm Tealeaf Cx

Publicado 2014-03-06 · Atualizado 2017-08-29 · CVE-2013-6720

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Tealeaf CX versions 7.x, 8.x through 8.6, 8.7 through 8.7 before FP2, 8.8 through 8.8 before FP2

Description The issue allows remote authenticated users to bypass intended access restrictions via a .. (dot dot) in the log parameter of the download.php file in the Passive Capture Application (PCA) web console. This can be exploited by sending a crafted request for a customer-support file, potentially accessing sensitive log files.

Recommendations For IBM Tealeaf CX versions 7.x, update to a version that includes the fix for this issue. For IBM Tealeaf CX versions 8.x through 8.6, update to a version that includes the fix for this issue. For IBM Tealeaf CX versions 8.7 before FP2, apply FP2 or a later fix pack to resolve the issue. For IBM Tealeaf CX versions 8.8 before FP2, apply FP2 or a later fix pack to resolve the issue. As a temporary workaround, consider restricting access to the download.php file in the PCA web console to minimize the risk of exploitation.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2013-6720

Produtos afetados

Ibm Tealeaf Cx

Referências · 5

• 🔥 https://exploit-db.com/exploits/32546 · Exploit
• 🔥 http://exploit-db.com/exploits/32546 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-6720 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89229 · Nota
• https://tealeaf.support.ibmcloud.com/FileManagement/Download/19eb90ffb8334b398684b4350edc4b7a · Aviso do Fabricante