Lucene search

IbmCVE-2014-3088

HistoryJul 01, 2014 - 8:55 p.m.

CVE-2014-3088

2014-07-0120:55:05

CWE-264

ibm

web.nvd.nist.gov

ibm

sametime meeting server

cve-2014-3088

security bypass

file upload

validation

nvd

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

AI Score

6.2

Confidence

Low

EPSS

0.002

Percentile

55.6%

JSON

stconf.nsf in IBM Sametime Meeting Server 8.5.1 relies on the client to validate the file format used in wAttach?OpenForm multipart/form-data POST requests, which allows remote authenticated users to bypass intended upload restrictions by modifying the Content-Type header and file extension, as demonstrated by replacing a text/plain .txt upload with an application/octet-stream .exe upload.

Affected configurations

Nvd

Node

ibmsametime_meeting_serverMatch8.5.1

VendorProductVersionCPE
ibmsametime_meeting_server8.5.1cpe:2.3:a:ibm:sametime_meeting_server:8.5.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	sametime_meeting_server	8.5.1	cpe:2.3:a:ibm:sametime_meeting_server:8.5.1:::::::*

References

linux.oracle.com/errata/ELSA-2014-0747.html

packetstormsecurity.com/files/127294

packetstormsecurity.com/files/127829/IBM-Sametime-Meet-Server-8.5-Arbitrary-File-Upload.html

www.securityfocus.com/bid/68291

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

AI Score

6.2

Confidence

Low

EPSS

0.002

Percentile

55.6%

JSON

Related for CVE-2014-3088