PT-2015-1379 · Ibm · Ibm Security Siteprotector System

Brennan Brazeau

+4

·

Publicado

2015-05-25

·

Atualizado

2015-05-26

·

CVE-2015-0171

CVSS v2.0

5.5

Média

VetorAV:N/AC:L/Au:S/C:N/I:P/A:P
Name of the Vulnerable Software and Affected Versions IBM Security SiteProtector System versions 3.0 through 3.0.0.6 IBM Security SiteProtector System versions 3.1 through 3.1.0.3 IBM Security SiteProtector System versions 3.1.1 through 3.1.1.1
Description The issue allows remote authenticated users to write to arbitrary files. This is due to incorrect restriction of the directory path name with limited access. Exploitation of the issue may allow a remote attacker to record arbitrary files.
Recommendations For IBM Security SiteProtector System versions 3.0 through 3.0.0.6, update to version 3.0.0.7. For IBM Security SiteProtector System versions 3.1 through 3.1.0.3, update to version 3.1.0.4. For IBM Security SiteProtector System versions 3.1.1 through 3.1.1.1, update to version 3.1.1.2.

Correção

Path traversal

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

BDU:2015-10472
CVE-2015-0171

Produtos afetados

Ibm Security Siteprotector System