PT-2014-3090 · Ibm · Ibm Global Retention Policy/Schedule Management+2

Published 2014-01-10 · Updated 2015-07-28 · CVE-2013-6321

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Atlas eDiscovery Process Management versions 6.0.1.5 and earlier and 6.0.2 IBM Disposal and Governance Management for IT versions 6.0.1.5 and earlier and 6.0.2 IBM Global Retention Policy and Schedule Management versions 6.0.1.5 and earlier and 6.0.2

Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Recommendations For IBM Atlas eDiscovery Process Management versions 6.0.1.5 and earlier and 6.0.2, update to a version later than 6.0.2. For IBM Disposal and Governance Management for IT versions 6.0.1.5 and earlier and 6.0.2, update to a version later than 6.0.2. For IBM Global Retention Policy and Schedule Management versions 6.0.1.5 and earlier and 6.0.2, update to a version later than 6.0.2.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2013-6321

Affected Products

Ibm Atlas Ediscovery Process Management

Ibm Disposal/Governance Management For It

Ibm Global Retention Policy/Schedule Management

References · 4

• http://ibm.com/connections/blogs/PSIRT/entry/security_bulletin_atlas_suite_atlas_policy_suite_sql_injection_vulnerability_cve_2013_6321_and_access_control_vulnerability_cve_2013_6334 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6321 · Security Note
• http://osvdb.org/101856 · Note
• http://securityfocus.com/bid/64749 · Note