IBM TRIRIGA Application Platform 3.3/3.4/3.5 Builder Tools access control

Summaryinfo

A vulnerability identified as critical has been detected in IBM TRIRIGA Application Platform 3.3/3.4/3.5. This affects an unknown function of the component Builder Tools. This manipulation causes access control. This vulnerability is registered as CVE-2017-1371. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability classified as critical was found in IBM TRIRIGA Application Platform 3.3/3.4/3.5 (Service Management Software). Affected by this vulnerability is some unknown functionality of the component Builder Tools. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Builder tools running in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated user to execute Builder tool actions they do not have access to. IBM X-Force ID: 126864.

The bug was discovered 07/17/2017. The weakness was published 07/21/2017 (Website). The advisory is shared at ibm.com. This vulnerability is known as CVE-2017-1371 since 11/30/2016. The attack can be launched remotely. A single authentication is required for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 01/06/2021). It is expected to see the exploit prices for this product increasing in the near future.MITRE ATT&CK project uses the attack technique T1068 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Similar entries are available at VDB-104368, VDB-104366 and VDB-104367. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Service Management Software

Vendor

• IBM

Name

• TRIRIGA Application Platform

Version

• 3.3
• 3.4
• 3.5

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion