CVE-2016-5990

IBM Security Privileged Identity Manager Virtual Appliance allows an authenticated user to upload malicious files that would be automatically executed by the server.

CVSS v3 6.3 MEDIUM
CVSS v2.0 6.5 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.ibm.com/support/docview.wss?uid=swg21996614	Patch Vendor Advisory
http://www.securityfocus.com/bid/95199	Patch VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:security_privileged_identity_manager:2.0.2:::::::*
	cpe:2.3:a:ibm:security_privileged_identity_manager:2.1:::::::*

History

No history.

Information

Published : 2017-02-01 20:59

Updated : 2023-12-10 12:01

NVD link : CVE-2016-5990

Mitre link : CVE-2016-5990

CVE.ORG link : CVE-2016-5990

JSON object : View

Products Affected

ibm

security_privileged_identity_manager

CWE

CWE-284

Improper Access Control

{"id": "CVE-2016-5990", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}]}, "published": "2017-02-01T20:59:01.567", "references": [{"url": "http://www.ibm.com/support/docview.wss?uid=swg21996614", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/95199", "tags": ["Patch", "VDB Entry"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "IBM Security Privileged Identity Manager Virtual Appliance allows an authenticated user to upload malicious files that would be automatically executed by the server."}, {"lang": "es", "value": "IBM Security Privileged Identity Manager Virtual Appliance permite a un usuario autenticado cargar archivos maliciosos que ser\u00edan ejecutados autom\u00e1ticamente por el servidor."}], "lastModified": "2017-02-07T21:15:00.910", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:security_privileged_identity_manager:2.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D07547A7-E87E-4085-983F-29BD485E3160"}, {"criteria": "cpe:2.3:a:ibm:security_privileged_identity_manager:2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8C26B4C2-D6EC-4367-9D59-BE9FF8DC2395"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}