PT-2014-3078 · Algo · Algo Risk Application

Published 2014-03-06 · Updated 2017-08-29 · CVE-2013-6304

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Algo Risk Application (ARA) versions 2.4.0.1 through 4.9.1

Description The issue allows remote authenticated users to bypass intended access restrictions. This is achieved by providing a crafted pathname for either a configuration or a JAR file, exploiting multiple directory traversal vulnerabilities.

Recommendations For versions 2.4.0.1 through 4.9.1, consider restricting access to sensitive configuration and JAR files to minimize the risk of exploitation until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2013-6304

Affected Products

Algo Risk Application

References · 4

• http://www-01.ibm.com/support/docview.wss?uid=swg21666093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6304 · Security Note
• http://securityfocus.com/bid/65929 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/88535 · Note