Vulnerability CVE-2009-0809

Vulnerability Name:

CVE-2009-0809 (CCN-48894)

Assigned:

2009-02-24

Published:

2009-02-24

Updated:

2009-07-22

Summary:

The Web Editor in Dassault Systemes ENOVIA SmarTeam V5 before Release 18 Service Pack 8, and possibly CATIA and other products, allows remote authenticated users to read the profile card of an object in the document class via a link that is sent from the owner of the document object.
Per http://www-01.ibm.com/support/docview.wss?uid=swg1HD80332

"Scenario:
1. Create a document class and give permissions to joe only.
2. When someone else but joe logs onto Web editor, and does a
search on this new class no results are returned as expected.
3. Login as joe and search for an object created for this new
class. click on the email icon, and send the mail to bob.
4. When bob clicks on the link in the email, he can view the
profile card of the object, but when he clicks on viewer he
gets an unauthorized operation error. Bob shouldn't be able
to view the profile card in the first place as he doesn't
have any access to this class. This is a security hole in
the web editor."

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

3.5 Low (CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N)
2.6 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.2 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-264

Vulnerability Consequences:

Other

References:

Source: MITRE
Type: CNA
CVE-2009-0809

Source: CCN
Type: SA34037
CATIA V5 Web Editor Unspecified Vulnerability

Source: SECUNIA
Type: Vendor Advisory
34037

Source: AIXAPAR
Type: Vendor Advisory
HD80332

Source: CCN
Type: IBM APAR HD80332
SECURITY HOLE IN WEB EDITOR

Source: CCN
Type: IBM Support & Downloads Web site
CATIA/ENOVIA/DELMIA V5R18 ServicePack8 Program Directory

Source: CCN
Type: OSVDB ID: 55800
ENOVIA SmarTeam V5 Web Editor Unauthorized Profile Card Access

Source: BID
Type: UNKNOWN
33895

Source: CCN
Type: BID-33895
CATIA V5 Unspecified Vulnerability

Source: VUPEN
Type: Vendor Advisory
ADV-2009-0525

Source: XF
Type: UNKNOWN
webeditor-profilecard-info-disclosure(48894)

Vulnerable Configuration:

Configuration 1:

cpe:/a:3ds:enovia_smarteam:*:*:*:*:*:*:*:* (Version <= 5.18)

OR cpe:/a:ibm:catia:5.16:*:*:*:*:*:*:*

OR cpe:/a:ibm:catia:5.17:*:*:*:*:*:*:*

OR cpe:/a:ibm:catia:*:*:*:*:*:*:*:* (Version <= 5.18)

Denotes that component is vulnerable

BACK