Security Bulletin: IBM Content Collector affected by information disclosure vulnerability (CVE-2015-0146)

Summary

IBM Content Collector for Email could allow a local attacker to obtain sensitive information, caused by improper handling of a search query. This error occurs only for searches on IBM FileNet P8 systems that are configured with IBM Content Search Services.

Vulnerability Details

CVEID: CVE-2015-0146**
DESCRIPTION:** IBM Content Collector for Email could allow a local attacker to obtain sensitive information, caused by improper handling of a search query. By using some specific query operator, an attacker could exploit this vulnerability to obtain access to documents that the logged on user is not authorized to access.
CVSS Base Score: 2.1
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/100761 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:L/AC:L/Au:N/C:P/I:N/A:N)

Affected Products and Versions

IBM Content Collector 3.0
IBM Content Collector 4.0

Remediation/Fixes

Product

| VRMF|Remediation/First Fix
—|—|—
IBM Content Collector | 3.0.0.6| Apply Interim Fix 3.0.0.6-IBM-ICC-Server-IF001, available from Fix Central
IBM Content Collector| 4.0.0.3| Apply Interim Fix 4.0.0.3-IBM-ICC-Server-IF001 , available from Fix Central

Workarounds and Mitigations

None