PT-2015-1379 · Ibm · Ibm Security Siteprotector System

Brennan Brazeau + 4 · Published 2015-05-25 · Updated 2015-05-26 · CVE-2015-0171

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Security SiteProtector System versions 3.0 through 3.0.0.6 IBM Security SiteProtector System versions 3.1 through 3.1.0.3 IBM Security SiteProtector System versions 3.1.1 through 3.1.1.1

Description The issue allows remote authenticated users to write to arbitrary files. This is due to incorrect restriction of the directory path name with limited access. Exploitation of the issue may allow a remote attacker to record arbitrary files.

Recommendations For IBM Security SiteProtector System versions 3.0 through 3.0.0.6, update to version 3.0.0.7. For IBM Security SiteProtector System versions 3.1 through 3.1.0.3, update to version 3.1.0.4. For IBM Security SiteProtector System versions 3.1.1 through 3.1.1.1, update to version 3.1.1.2.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2015-10472

CVE-2015-0171

Affected Products

Ibm Security Siteprotector System

References · 3

• http://www-01.ibm.com/support/docview.wss?uid=swg21699470 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10472 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-0171 · Security Note