PT-2014-3079 · Ibm · Ibm Platform Symphony

Published 2014-01-21 · Updated 2017-08-29 · CVE-2013-6305

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Platform Symphony versions 5.2 before build 229037 IBM Platform Symphony versions 6.1.0.1 before build 229073

Description The issue allows context-dependent attackers to obtain sensitive information by leveraging knowledge of the credentials encryption key used across different customers' installations.

Recommendations For IBM Platform Symphony version 5.2 before build 229037, update to a version that uses unique credentials encryption keys for each customer's installation. For IBM Platform Symphony version 6.1.0.1 before build 229073, update to a version that uses unique credentials encryption keys for each customer's installation.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-6305

Affected Products

Ibm Platform Symphony

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-6305 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=isg3T1020528 · Vendor Advisory
• http://osvdb.org/102262 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/88536 · Note