PT-2017-7610 · Ibm · Ibm Sametime Enterprise Meeting Server

Publicado 2017-08-29 · Atualizado 2017-09-07 · CVE-2016-0354

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Média

Vetor base

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Sametime Enterprise Meeting Server versions 8.5.2 through 9.0

Description The issue allows an authenticated user to upload a malicious file to a meeting room, which could then be downloaded by other users. This malicious file could be executed with the privileges of the user who downloads it.

Recommendations For versions 8.5.2 through 9.0, consider restricting file upload capabilities to trusted users or disabling file sharing in meeting rooms until a fix is available.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2016-0354

Produtos afetados

Ibm Sametime Enterprise Meeting Server

Referências · 6

• http://ibm.com/support/docview.wss?uid=swg22006439 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0354 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-0354 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/111893 · Aviso do Fabricante
• http://securitytracker.com/id/1039231 · Nota
• http://securityfocus.com/bid/100599 · Nota