PT-2014-5073 · Ibm · Ibm Gcm16+1

Alejandro Alvarez Bravo · Published 2014-08-17 · Updated 2017-08-29 · CVE-2014-3081

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:N/AC:M/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447

Description The issue allows remote authenticated users to read arbitrary files. This is achieved via the filename parameter in the prodtest.php file.

Recommendations For firmware versions before 1.20.20.23447, update the firmware to version 1.20.20.23447 or later to resolve the issue.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2014-3081

Affected Products

Ibm Gcm16

Ibm Gcm32

References · 7

• 🔥 https://exploit-db.com/exploits/34132 · Exploit
• 🔥 http://packetstormsecurity.com/files/127543/IBM-1754-GCM-KVM-Code-Execution-File-Read-XSS.html · Exploit
• 🔥 http://exploit-db.com/exploits/34132 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-3081 · Security Note
• http://ibm.com/support/entry/portal/docdisplay?lndocid=migr-5095983 · Vendor Advisory
• http://seclists.org/fulldisclosure/2014/Jul/113 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/93930 · Note