PT-2014-5604 · Rocket · Rocket Servergraph Admin Center For Tivoli Storage Manager

Andrea Micalizzi + 1 · Publicado 2014-06-02 · Atualizado 2014-06-12 · CVE-2014-3915

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Rocket Servergraph Admin Center for Tivoli Storage Manager (affected versions not specified)

Description The issue concerns the userRequest servlet in the Admin Center for Tivoli Storage Manager in Rocket Servergraph, which allows remote attackers to execute arbitrary commands. This can be achieved through various commands, including auth, auth session, auth simple, add, add flat, remove, set pwd, add permissions, revoke permissions, runAsync, or tsmRequest. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2014-3915

ZDI-14-164

Produtos afetados

Rocket Servergraph Admin Center For Tivoli Storage Manager

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-3915 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-14-164 · Nota de Segurança
• http://securityfocus.com/bid/67780 · Nota
• http://zerodayinitiative.com/advisories/ZDI-14-164 · Nota