Vulnerability CVE-2013-4006

Vulnerability Name:

CVE-2013-4006 (CCN-85273)

Assigned:

2013-11-11

Published:

2013-11-11

Updated:

2017-08-29

Summary:

IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.5.1 uses weak permissions for unspecified files, which allows local users to obtain sensitive information via standard filesystem operations.

CVSS v3 Severity:

2.6 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
3.2 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

3.5 Low (CCN CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N)
2.6 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

CWE-310

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2013-4006

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?&uid=swg21651880

Source: AIXAPAR
Type: UNKNOWN
PM90472

Source: CCN
Type: IBM Security Bulletin 1651880
Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.5.1

Source: CCN
Type: OSVDB ID: 99762
IBM WebSphere Application Server (WAS) Liberty Profile Permission Local Information Disclosure Weakness

Source: XF
Type: UNKNOWN
was-cve20134006-info-disclosure(85273)

Source: XF
Type: UNKNOWN
was-cve20134006-liberty-perm(85273)

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:websphere_application_server:8.5.0.0:-:liberty_profile:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.0.1:-:liberty_profile:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.0.2:-:liberty_profile:*:*:*:*:*

OR cpe:/a:ibm:websphere_application_server:8.5.5.0:-:liberty_profile:*:*:*:*:*

Configuration CCN 1:

cpe:/a:ibm:websphere_application_server:8.5:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK