PT-2014-3178 · Ibm · Ibm Websphere Dashboard Framework

Published 2014-02-14 · Updated 2017-08-29 · CVE-2013-6728

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM WebSphere Dashboard Framework versions 6.1.5 through 7.0.1

Description The issue concerns the charting component in IBM WebSphere Dashboard Framework, which has incorrect security constraints for a temporary directory. This allows remote attackers to view or delete image files.

Recommendations For versions 6.1.5 through 7.0.1, consider restricting access to the temporary directory to prevent unauthorized viewing or deletion of image files. As a temporary workaround, restrict access to the charting component until a fix is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-6728

Affected Products

Ibm Websphere Dashboard Framework

References · 5

• http://www-01.ibm.com/support/docview.wss?uid=swg21663022 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1LO78265 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1LO78266 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6728 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89283 · Note