PT-2012-2056 · Sybase · Sybase M-Business Anywhere

Published 2012-02-08 · Updated 2012-02-09 · CVE-2011-5078

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sybase M-Business Anywhere versions 6.7 through 6.7 before ESD# 3 Sybase M-Business Anywhere versions 7.0 through 7.0 before ESD# 7

Description The web administration interface in the server does not require admin authentication for certain scripts, allowing remote authenticated users to list or delete user accounts, modify passwords, or read log files via HTTP requests.

Recommendations For Sybase M-Business Anywhere version 6.7, update to ESD# 3 or later. For Sybase M-Business Anywhere version 7.0, update to ESD# 7 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2011-5078

Affected Products

Sybase M-Business Anywhere

References · 3

• http://sybase.com/detail?id=1095200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-5078 · Security Note
• http://verisigninc.com/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=952 · Note