Vulnerability CVE-2013-5459 - CERT Civis.Net

Vulnerability Name:

CVE-2013-5459 (CCN-84773)

Assigned:

2013-08-22

Published:

2014-02-28

Updated:

2017-08-29

Summary:

Unspecified vulnerability in IBM Rational Software Architect (RSA) Design Manager and Rational Rhapsody Design Manager 3.x through 3.0.1 and 4.x before 4.0.6 allows remote authenticated users to modify data by leveraging improper parameter checking.

CVSS v3 Severity:

2.6 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

5.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:P)
4.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): Partial

3.5 Low (CCN CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N)
2.6 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2013-5459

Source: CCN
Type: SA58086
IBM Rational Software Architect Design Manager / Rhapsody Design Manager Data Manipulation Weakness

Source: CCN
Type: IBM Security Bulletin 1664531
Vulnerability in Rational Software Architect Design Manager and Rhapsody Design Manager (CVE-2013-5459)

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21664531

Source: CCN
Type: BID-66987
Multiple IBM Products CVE-2013-5459 Unspecified Security Vulnerability

Source: XF
Type: UNKNOWN
ibm-rhapsody-cvet20135459-response-splitting(84773)

Source: XF
Type: UNKNOWN
ibm-rsa-cve20135459-integrity(84773)

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:rhapsody_design_manager:3.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:3.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:4.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:4.0.5:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:ibm:rational_software_architect_design_manager:3.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:3.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.5:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:ibm:rhapsody_design_manager:3.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:3.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:4.0.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:3.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:3.0.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:4.0.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:4.0.2:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:4.0.3:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:4.0.4:*:*:*:*:*:*:*

OR cpe:/a:ibm:rational_software_architect_design_manager:4.0.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:rhapsody_design_manager:4.0.5:*:*:*:*:*:*:*

Denotes that component is vulnerable