PT-2015-3825 · Ibm · Workload Deployer+1

Published 2015-01-10 · Updated 2017-09-08 · CVE-2014-6158

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM PureApplication System versions 1.0 through 1.0.0.4 before iFix 10 IBM PureApplication System versions 1.1 through 1.1.0.5 IBM PureApplication System versions 2.0 through 2.0.0.1 Workload Deployer version 3.1.0.7 before IF5

Description The issue allows remote authenticated users to execute arbitrary code via a (1) Script Package, (2) Add-On, or (3) Emergency Fixes component in the file-upload feature.

Recommendations For IBM PureApplication System versions 1.0 through 1.0.0.4, apply iFix 10 to resolve the issue. For IBM PureApplication System versions 1.1 through 1.1.0.5, update to version 1.1.0.5 or later. For IBM PureApplication System versions 2.0 through 2.0.0.1, update to version 2.0.0.1 or later. For Workload Deployer version 3.1.0.7, apply IF5 to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2014-6158

Affected Products

Ibm Pureapplication System

Workload Deployer

References · 6

• http://www-01.ibm.com/support/docview.wss?uid=swg21693292 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-6158 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21693440 · Vendor Advisory
• http://secunia.com/advisories/62032 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/97707 · Note
• http://secunia.com/advisories/61956 · Note