Multiple vulnerabilities in IBM Tivoli Netcool Configuration Manager



Risk High
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2015-5211
CVE-2020-5421
CWE-ID CWE-552
CWE-20
Exploitation vector Network
Public exploit Public exploit code for vulnerability #2 is available.
Vulnerable software
 IBM Tivoli Netcool Configuration Manager
Other software / Other software solutions

Vendor IBM Corporation

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Files or Directories Accessible to External Parties

EUVDB-ID: #VU77101

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2015-5211

CWE-ID: CWE-552 - Files or Directories Accessible to External Parties

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to Reflected File Download (RFD) attack. A remote unauthenticated attacker can perform a Reflected File Download (RFD) attack by tricking victim into opening a specially crafted URL with a batch script extension and then execute arbitrary code on the target system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Tivoli Netcool Configuration Manager: before 6.4.2.18

CPE2.3 External links

http://www.ibm.com/support/pages/node/7001557


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper input validation

EUVDB-ID: #VU49739

Risk: Medium

CVSSv4.0: 5.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N/E:P/U:Green]

CVE-ID: CVE-2020-5421

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

Description

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Core (Spring Framework) component in Oracle Communications Session Report Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Tivoli Netcool Configuration Manager: before 6.4.2.18

CPE2.3 External links

http://www.ibm.com/support/pages/node/7001557


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###