PT-2014-3095 · Ibm · Ibm Global Retention Policy/Schedule Management+2

Published 2014-01-10 · Updated 2015-07-28 · CVE-2013-6334

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Atlas eDiscovery Process Management versions 6.0.1.5 and earlier and 6.0.2 Disposal and Governance Management for IT versions 6.0.1.5 and earlier and 6.0.2 Global Retention Policy and Schedule Management versions 6.0.1.5 and earlier and 6.0.2

Description The issue allows remote attackers to bypass intended access restrictions due to improper session validation. This can lead to unauthorized access to the "PolicyAtlas/ResponseDraftServlet" (also known as the Compliance Questionnaire Save Draft servlet) via unspecified vectors.

Recommendations For IBM Atlas eDiscovery Process Management versions 6.0.1.5 and earlier and 6.0.2, update to a version that properly validates sessions. For Disposal and Governance Management for IT versions 6.0.1.5 and earlier and 6.0.2, update to a version that properly validates sessions. For Global Retention Policy and Schedule Management versions 6.0.1.5 and earlier and 6.0.2, update to a version that properly validates sessions. As a temporary workaround, consider restricting access to the PolicyAtlas/ResponseDraftServlet to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-6334

Affected Products

Ibm Disposal/Governance Management For It

Ibm Global Retention Policy/Schedule Management

Ibm Atlas Ediscovery Process Management

References · 4

• http://ibm.com/connections/blogs/PSIRT/entry/security_bulletin_atlas_suite_atlas_policy_suite_sql_injection_vulnerability_cve_2013_6321_and_access_control_vulnerability_cve_2013_6334 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6334 · Security Note
• http://securityfocus.com/bid/64751 · Note
• http://osvdb.org/show/osvdb/101855 · Note