PT-2015-4114 · Ibm · Ibm Tririga Application Platform

Published 2015-01-29 · Updated 2017-09-08 · CVE-2014-8895

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM TRIRIGA Application Platform versions 3.2.1.x through 3.3.2 before 3.3.2.3 IBM TRIRIGA Application Platform versions 3.4.1 before 3.4.1.1

Description The issue allows remote attackers to bypass intended access restrictions and read the image files of arbitrary users via a crafted URL.

Recommendations For versions 3.2.1.x, update to a version after 3.3.2.3 or apply the necessary patches to restrict access to image files. For versions 3.3.2 before 3.3.2.3, update to version 3.3.2.3 or later to fix the issue. For versions 3.4.1 before 3.4.1.1, update to version 3.4.1.1 or later to resolve the problem.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-8895

Affected Products

Ibm Tririga Application Platform

References · 5

• http://www-01.ibm.com/support/docview.wss?uid=swg21694771 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8895 · Security Note
• http://secunia.com/advisories/62674 · Note
• http://securityfocus.com/bid/72430 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/99014 · Note