Lucene search

[email protected]CVE-2013-5465

HistoryMay 26, 2014 - 4:55 p.m.

CVE-2013-5465

2014-05-2616:55:02

CWE-264

[email protected]

web.nvd.nist.gov

ibm

maximo asset management

smartcloud control desk

file types

uploads

security vulnerability

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

6.5 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

59.7%

JSON

IBM Maximo Asset Management 7.x before 7.1.1.7 LAFIX.20140319-0837, 7.1.1.11 before IFIX.20140323-0749, 7.1.1.12 before IFIX.20140321-1336, 7.5.x before 7.5.0.3 IFIX027, and 7.5.0.4 before IFIX011; SmartCloud Control Desk 7.x before 7.5.0.3 and 7.5.1.x before 7.5.1.2; and Tivoli IT Asset Management for IT, Tivoli Service Request Manager, Maximo Service Desk, and Change and Configuration Management Database (CCMDB) 7.x before 7.1.1.7 LAFIX.20140319-0837, 7.1.1.11 before IFIX.20140207-1801, and 7.1.1.12 before IFIX.20140218-1510 do not properly restrict file types during uploads, which allows remote authenticated users to have an unspecified impact via an invalid type.

Affected configurations

NVD

Node

ibmmaximo_asset_managementMatch7.5.0.0

ibmmaximo_asset_managementMatch7.5.0.1

ibmmaximo_asset_managementMatch7.5.0.2

ibmmaximo_asset_managementMatch7.5.0.3

ibmmaximo_asset_managementMatch7.5.0.4

Node

ibmchange_and_configuration_management_databaseMatch7.1.1.7

ibmchange_and_configuration_management_databaseMatch7.1.1.11

ibmchange_and_configuration_management_databaseMatch7.1.1.12

ibmmaximo_service_deskMatch7.1.1.7

ibmmaximo_service_deskMatch7.1.1.11

ibmmaximo_service_deskMatch7.1.1.12

ibmtivoli_asset_management_for_itMatch7.0

ibmtivoli_asset_management_for_itMatch7.1

ibmtivoli_it_asset_management_for_itMatch7.1.1.7

ibmtivoli_it_asset_management_for_itMatch7.1.1.11

ibmtivoli_it_asset_management_for_itMatch7.1.1.12

ibmtivoli_service_request_managerMatch7.0

ibmtivoli_service_request_managerMatch7.1.0.0

ibmtivoli_service_request_managerMatch7.1.1

ibmtivoli_service_request_managerMatch7.1.1.7

ibmtivoli_service_request_managerMatch7.1.1.11

ibmtivoli_service_request_managerMatch7.1.1.12

Node

ibmsmartcloud_control_deskMatch7.0

ibmsmartcloud_control_deskMatch7.5

ibmsmartcloud_control_deskMatch7.5.0.0

ibmsmartcloud_control_deskMatch7.5.0.1

ibmsmartcloud_control_deskMatch7.5.0.2

ibmsmartcloud_control_deskMatch7.5.1.0

ibmsmartcloud_control_deskMatch7.5.1.1

Node

ibmmaximo_asset_managementMatch7.1

ibmmaximo_asset_managementMatch7.1.1

ibmmaximo_asset_managementMatch7.1.1.1

ibmmaximo_asset_managementMatch7.1.1.2

ibmmaximo_asset_managementMatch7.1.1.5

ibmmaximo_asset_managementMatch7.1.1.6

ibmmaximo_asset_managementMatch7.1.1.7

ibmmaximo_asset_managementMatch7.1.1.11

ibmmaximo_asset_managementMatch7.1.1.12

CPENameOperatorVersion
ibm:maximo_asset_managementibm maximo asset managementeq7.5.0.0
ibm:maximo_asset_managementibm maximo asset managementeq7.5.0.1
ibm:maximo_asset_managementibm maximo asset managementeq7.5.0.2
ibm:maximo_asset_managementibm maximo asset managementeq7.5.0.3
ibm:maximo_asset_managementibm maximo asset managementeq7.5.0.4

CPE	Name	Operator	Version
ibm:maximo_asset_management	ibm maximo asset management	eq	7.5.0.0
ibm:maximo_asset_management	ibm maximo asset management	eq	7.5.0.1
ibm:maximo_asset_management	ibm maximo asset management	eq	7.5.0.2
ibm:maximo_asset_management	ibm maximo asset management	eq	7.5.0.3
ibm:maximo_asset_management	ibm maximo asset management	eq	7.5.0.4

References

www-01.ibm.com/support/docview.wss?uid=swg1IV46511

www-01.ibm.com/support/docview.wss?uid=swg21670870

exchange.xforce.ibmcloud.com/vulnerabilities/88364

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

6.5 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

59.7%

JSON

Related for CVE-2013-5465

nvd1 cvelist1 prion1 ibm1