CVE-2013-2989

2013-05-2816:55:01

CWE-264

[email protected]

web.nvd.nist.gov

CVSS2

6.8

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:S/C:C/I:C/A:C

AI Score

6.3

Confidence

Low

EPSS

Percentile

5.1%

JSON

The file-copying functionality in IBM Sterling Connect:Direct 3.8.00, 4.0.00, and 4.1.0 for UNIX on AIX 6.1 through 7.1 uses incorrect privileges, which allows local users to bypass filesystem read permissions and write permissions by leveraging authentication to the Connect:Direct product.

Affected configurations

Nvd

Node

ibmsterling_connectMatch3.8.00

ibmsterling_connectMatch4.0.00

ibmsterling_connectMatch4.1.0.0

VendorProductVersionCPE
ibmsterling_connect3.8.00cpe:2.3:a:ibm:sterling_connect:3.8.00:*:*:*:*:*:*:*
ibmsterling_connect4.0.00cpe:2.3:a:ibm:sterling_connect:4.0.00:*:*:*:*:*:*:*
ibmsterling_connect4.1.0.0cpe:2.3:a:ibm:sterling_connect:4.1.0.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	sterling_connect	3.8.00	cpe:2.3:a:ibm:sterling_connect:3.8.00:::::::*
ibm	sterling_connect	4.0.00	cpe:2.3:a:ibm:sterling_connect:4.0.00:::::::*
ibm	sterling_connect	4.1.0.0	cpe:2.3:a:ibm:sterling_connect:4.1.0.0:::::::*