CVE-2013-4006

2013-11-1805:23:57

CWE-310

ibm

web.nvd.nist.gov

ibm

websphere

application server

was

liberty profile

security

weak permissions

cve-2013-4006

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

8.2

Confidence

High

EPSS

0.001

Percentile

41.3%

JSON

IBM WebSphere Application Server (WAS) Liberty Profile 8.5 before 8.5.5.1 uses weak permissions for unspecified files, which allows local users to obtain sensitive information via standard filesystem operations.

Affected configurations

Nvd

Node

ibmwebsphere_application_serverMatch8.5.0.0-liberty_profile

ibmwebsphere_application_serverMatch8.5.0.1-liberty_profile

ibmwebsphere_application_serverMatch8.5.0.2-liberty_profile

ibmwebsphere_application_serverMatch8.5.5.0-liberty_profile

VendorProductVersionCPE
ibmwebsphere_application_server8.5.0.0cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:-:liberty_profile:*:*:*:*:*
ibmwebsphere_application_server8.5.0.1cpe:2.3:a:ibm:websphere_application_server:8.5.0.1:-:liberty_profile:*:*:*:*:*
ibmwebsphere_application_server8.5.0.2cpe:2.3:a:ibm:websphere_application_server:8.5.0.2:-:liberty_profile:*:*:*:*:*
ibmwebsphere_application_server8.5.5.0cpe:2.3:a:ibm:websphere_application_server:8.5.5.0:-:liberty_profile:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	websphere_application_server	8.5.0.0	cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:-:liberty_profile:::::*
ibm	websphere_application_server	8.5.0.1	cpe:2.3:a:ibm:websphere_application_server:8.5.0.1:-:liberty_profile:::::*
ibm	websphere_application_server	8.5.0.2	cpe:2.3:a:ibm:websphere_application_server:8.5.0.2:-:liberty_profile:::::*
ibm	websphere_application_server	8.5.5.0	cpe:2.3:a:ibm:websphere_application_server:8.5.5.0:-:liberty_profile:::::*