| Vulnerability Name: | CVE-2011-2758 (CCN-68338) | ||||||||
| Assigned: | 2011-06-28 | ||||||||
| Published: | 2011-06-28 | ||||||||
| Updated: | 2011-07-19 | ||||||||
| Summary: | IDSWebApp in the Web Administration Tool in IBM Tivoli Directory Server (TDS) 6.2 before 6.2.0.3-TIV-ITDS-IF0004 does not require authentication for access to LDAP Server log files, which allows remote attackers to obtain sensitive information via a crafted URL. | ||||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
| ||||||||
| CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N) 3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)
| ||||||||
| Vulnerability Type: | CWE-287 | ||||||||
| Vulnerability Consequences: | Obtain Information | ||||||||
| References: | Source: MITRE Type: CNA CVE-2011-2758 Source: CCN Type: SA45107 IBM Tivoli Directory Server Log File Information Disclosure Security Issue Source: SECUNIA Type: Vendor Advisory 45107 Source: CONFIRM Type: UNKNOWN http://www.ibm.com/support/docview.wss?crawler=1&uid=swg1IO14060 Source: AIXAPAR Type: UNKNOWN IO14060 Source: CCN Type: IBM Support and Downloads Tivoli Directory Server, Version 6.2.0.3-TIV-ITDS-IF0004 (6.2.0.18) Source: CONFIRM Type: UNKNOWN http://www.ibm.com/support/docview.wss?uid=swg24030320 Source: CCN Type: OSVDB ID: 73546 IBM Tivoli Directory Server Web Administration Tool IDSWebApp Log File Information Disclosure Source: BID Type: UNKNOWN 48512 Source: CCN Type: BID-48512 IBM Tivoli Directory Server Log File Information Disclosure Vulnerability Source: XF Type: UNKNOWN ibm-tds-admintool-info-disclosure(68338) | ||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||
| BACK | |||||||||