Multiple vulnerabilities in IBM Algo Credit Manager

1) Improper access control

EUVDB-ID: #VU9120

Risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10356

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The weakness exists due to a flaw in the Security component. A remote attacker can gain unauthorized access to sensitive information.

Mitigation

Update to version 5.4.1.0, 5.3.0.5, 5.2.0.5.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4

CPE2.3

External links

https://www-01.ibm.com/support/docview.wss?uid=swg22011316&myns=swgimgmt&mynp=OCSSNM52&mync=E&cm_sp=swgimgmt-_-OCSSNM52-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU8878

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10357

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the Serialization component. A remote attacker can trigger partial denial of service.

Mitigation

Update to version 5.4.1.0, 5.3.0.5, 5.2.0.5.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4

CPE2.3

External links

https://www-01.ibm.com/support/docview.wss?uid=swg22011316&myns=swgimgmt&mynp=OCSSNM52&mync=E&cm_sp=swgimgmt-_-OCSSNM52-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper access control

EUVDB-ID: #VU8873

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10348

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the Libraries component. A remote attacker can trigger partial denial of service.

Mitigation

Update to version 5.4.1.0, 5.3.0.5, 5.2.0.5.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4

CPE2.3

External links

https://www-01.ibm.com/support/docview.wss?uid=swg22011316&myns=swgimgmt&mynp=OCSSNM52&mync=E&cm_sp=swgimgmt-_-OCSSNM52-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper access control

EUVDB-ID: #VU8874

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10349

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the JAXP component. A remote attacker can trigger partial denial of service.

Mitigation

Update to version 5.4.1.0, 5.3.0.5, 5.2.0.5.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4

CPE2.3

External links

https://www-01.ibm.com/support/docview.wss?uid=swg22011316&myns=swgimgmt&mynp=OCSSNM52&mync=E&cm_sp=swgimgmt-_-OCSSNM52-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Denial of service

EUVDB-ID: #VU8864

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10347

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the Serialization component. A remote attacker can trigger partial denial of service on the target system.

Mitigation

Update to version 5.4.1.0, 5.3.0.5, 5.2.0.5.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4

CPE2.3

External links

https://www-01.ibm.com/support/docview.wss?uid=swg22011316&myns=swgimgmt&mynp=OCSSNM52&mync=E&cm_sp=swgimgmt-_-OCSSNM52-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper access control

EUVDB-ID: #VU8875

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10350

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the JAX-WS component. A remote attacker can trigger partial denial of service.

Mitigation

Update to version 5.4.1.0, 5.3.0.5, 5.2.0.5.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4

CPE2.3

External links

https://www-01.ibm.com/support/docview.wss?uid=swg22011316&myns=swgimgmt&mynp=OCSSNM52&mync=E&cm_sp=swgimgmt-_-OCSSNM52-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Denial of service

EUVDB-ID: #VU8863

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-10281

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the Serialization component. A remote attacker can trigger partial denial of service on the target system.

Mitigation

Update to version 5.4.1.0, 5.3.0.5, 5.2.0.5.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4

CPE2.3

External links

https://www-01.ibm.com/support/docview.wss?uid=swg22011316&myns=swgimgmt&mynp=OCSSNM52&mync=E&cm_sp=swgimgmt-_-OCSSNM52-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	Low
Patch available	YES
Number of vulnerabilities	7
CVE-ID	CVE-2017-10356 CVE-2017-10357 CVE-2017-10348 CVE-2017-10349 CVE-2017-10347 CVE-2017-10350 CVE-2017-10281
CWE-ID	CWE-264
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	IBM Algo Credit Manager Client/Desktop applications / Other client software
Vendor	IBM Corporation