Security Bulletin: Blind SQL injection vulnerability in IBM OpenPages GRC Platform API (CVE-2015-5049)

Summary

A blind SQL injection vulnerability has been found in the OpenPages GRC Platform API that could allow retrival or manipulation of information in the database.

Vulnerability Details

CVEID: CVE-2015-5049**
DESCRIPTION:** IBM OpenPages GRC Platform is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/106946 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

IBM OpenPages GRC platform 7.1
IBM OpenPages GRC platform 7.0

Remediation/Fixes

Patch

| Download URL
—|—
IBM OpenPages GRC Platform 7.1.0.1 IF6| http://www.ibm.com/support/docview.wss?uid=swg24041508
IBM OpenPages GRC platform 7.0.0.4 IF3| http://www.ibm.com/support/docview.wss?uid=swg24041514

Workarounds and Mitigations

Block client access to the GRC API via firewall or proxy rules. (i.e. the /grc/api/* URL)