PT-2015-1378 · Ibm · Ibm Security Siteprotector System

Published 2015-05-25 · Updated 2015-05-26 · CVE-2015-0169

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Security SiteProtector System versions 3.0 before 3.0.0.7 IBM Security SiteProtector System versions 3.1 before 3.1.0.4 IBM Security SiteProtector System versions 3.1.1 before 3.1.1.2

Description The issue allows remote authenticated users to inject arguments via unspecified vectors. This is due to the system's failure to neutralize special elements, which can be exploited by a remote attacker to inject their own command arguments.

Recommendations For versions 3.0 before 3.0.0.7, update to version 3.0.0.7 or later. For versions 3.1 before 3.1.0.4, update to version 3.1.0.4 or later. For versions 3.1.1 before 3.1.1.2, update to version 3.1.1.2 or later.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

BDU:2015-10471

CVE-2015-0169

Affected Products

Ibm Security Siteprotector System

References · 3

• http://www-01.ibm.com/support/docview.wss?uid=swg21699470 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0169 · Security Note
• https://bdu.fstec.ru/vul/2015-10471 · Security Note