Design/Logic Flaw

2018-01-2621:29:00

PRIOn knowledge base

www.prio-n.com

6.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

43.8%

JSON

IBM Tealeaf Customer Experience 8.7, 8.8, and 9.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing “dot dot” sequences (/…/) to view arbitrary files on the system. IBM X-Force ID: 124757.

CPENameOperatorVersion
tealeaf_customer_experienceeq9.0.2
tealeaf_customer_experienceeq8.7
tealeaf_customer_experienceeq8.8

Name	Operator	Version
tealeaf_customer_experience	eq	9.0.2
tealeaf_customer_experience	eq	8.7
tealeaf_customer_experience	eq	8.8

References

www.ibm.com/support/docview.wss?uid=swg22006392

exchange.xforce.ibmcloud.com/vulnerabilities/124757