PT-2015-3825 · Ibm · Workload Deployer+1

Publicado 2015-01-10 · Atualizado 2017-09-08 · CVE-2014-6158

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM PureApplication System versions 1.0 through 1.0.0.4 before iFix 10 IBM PureApplication System versions 1.1 through 1.1.0.5 IBM PureApplication System versions 2.0 through 2.0.0.1 Workload Deployer version 3.1.0.7 before IF5

Description The issue allows remote authenticated users to execute arbitrary code via a (1) Script Package, (2) Add-On, or (3) Emergency Fixes component in the file-upload feature.

Recommendations For IBM PureApplication System versions 1.0 through 1.0.0.4, apply iFix 10 to resolve the issue. For IBM PureApplication System versions 1.1 through 1.1.0.5, update to version 1.1.0.5 or later. For IBM PureApplication System versions 2.0 through 2.0.0.1, update to version 2.0.0.1 or later. For Workload Deployer version 3.1.0.7, apply IF5 to resolve the issue.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-6158

Produtos afetados

Ibm Pureapplication System

Workload Deployer

Referências · 6

• http://www-01.ibm.com/support/docview.wss?uid=swg21693292 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-6158 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg21693440 · Aviso do Fabricante
• http://secunia.com/advisories/62032 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/97707 · Nota
• http://secunia.com/advisories/61956 · Nota