CVE-2010-3475

{"id": "CVE-2010-3475", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-09-20T22:00:04.347", "references": [{"url": "http://osvdb.org/68122", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/41444", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC70406", "source": "cve@mitre.org"}, {"url": "http://www.ibm.com/support/docview.wss?uid=swg21446455", "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/43291", "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id?1024458", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2010/2425", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/61873", "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14609", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "IBM DB2 9.7 before FP3 does not properly enforce privilege requirements for execution of entries in the dynamic SQL cache, which allows remote authenticated users to bypass intended access restrictions by leveraging the cache to execute an UPDATE statement contained in a compiled compound SQL statement."}, {"lang": "es", "value": "IBM DB2 v9.7 anteriores a FP3 no aplican correctamente los requisitos de privilegio para la ejecuci\u00f3n de las entradas en la cach\u00e9 din\u00e1mica SQL, lo que permite a usuarios remotos autenticados eludir las restricciones de acceso destinados al aprovechar la cach\u00e9 para ejecutar una instrucci\u00f3n UPDATE contenida en una sentencia compilada de SQL."}], "lastModified": "2017-09-19T01:31:24.627", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:db2:9.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE1C4DE6-EB32-4A31-9FAA-D8DA31D8CF05"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8A8E221-7045-4BAD-9B29-ABBC5216559D"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56C39DC1-AD23-4F26-9727-EC0FBDF84BEE"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}