PT-2012-5594 · Ibm · Ibm Rational Automation Framework

Published 2012-12-26 · Updated 2017-08-29 · CVE-2012-4816

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Rational Automation Framework (RAF) versions 3.x through 3.0.0.5

Description The issue allows remote attackers to bypass intended access restrictions in the Env Gen Wizard by visiting specific context roots in HTTP sessions on port 8080.

Recommendations For versions 3.x through 3.0.0.5, restrict access to the Env Gen Wizard to minimize the risk of exploitation. Consider configuring the HTTP sessions on port 8080 to limit unauthorized access until a fix is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2012-4816

Affected Products

Ibm Rational Automation Framework

References · 3

• http://www-01.ibm.com/support/docview.wss?uid=swg21620359 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-4816 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/78379 · Note