IBM Initiate Master Data Service prior 10.0 Access Restriction access control
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
4.7 | $0-$5k | 0.00 |
A vulnerability classified as problematic was found in IBM Initiate Master Data Service. This vulnerability affects some unknown functionality of the component Access Restriction. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-264. As an impact it is known to affect confidentiality, and integrity. CVE summarizes:
IBM Initiate Master Data Service 9.5 before 9.5.093013, 9.7 before 9.7.093013, 10.0 before 10.0.093013, and 10.1 before 10.1.093013 does not properly restrict use of FRAME elements, which allows remote authenticated users to conduct phishing attacks, and bypass intended access restrictions or obtain sensitive information, via a crafted web site, related to a "frame injection" issue.
The weakness was shared 09/10/2014 (Website). The advisory is shared for download at www-01.ibm.com. This vulnerability was named CVE-2014-4786 since 07/09/2014. The attack can be initiated remotely. A single authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.
Upgrading to version 10.0 eliminates this vulnerability.
The vulnerability is also documented in the vulnerability database at X-Force (95033). The entries 71167, 71166, 71165 and 71163 are related to this item.
Product
Vendor
Name
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.4VulDB Meta Temp Score: 4.7
VulDB Base Score: 5.4
VulDB Temp Score: 4.7
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Access controlCWE: CWE-264
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Status: Unproven
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: Initiate Master Data Service 10.0
Timeline
07/09/2014 🔍09/10/2014 🔍
09/10/2014 🔍
09/24/2014 🔍
03/26/2015 🔍
03/17/2018 🔍
Sources
Vendor: ibm.comAdvisory: www-01.ibm.com
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2014-4786 (🔍)
X-Force: 95033 - IBM Initiate Master Data Service phishing through frames
SecurityFocus: 69720
Secunia: 60996 - IBM Initiate Master Data Service Multiple Vulnerabilities, Less Critical
See also: 🔍
Entry
Created: 03/26/2015 15:08Updated: 03/17/2018 11:19
Changes: 03/26/2015 15:08 (50), 03/17/2018 11:19 (8)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.