IBM UrbanCode Deploy up to 6.0.1.12/6.1.3.2/6.2.1.0 Logging information disclosure

Summaryinfo

A vulnerability was found in IBM UrbanCode Deploy up to 6.0.1.12/6.1.3.2/6.2.1.0 and classified as problematic. This vulnerability affects unknown code of the component Logging. Executing a manipulation can lead to information disclosure. This vulnerability appears as CVE-2016-0364. The attack may be performed from remote. There is no available exploit. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in IBM UrbanCode Deploy up to 6.0.1.12/6.1.3.2/6.2.1.0. This vulnerability affects an unknown code of the component Logging. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. CVE summarizes:

IBM UrbanCode Deploy 6.0.x before 6.0.1.13, 6.1.x before 6.1.3.3, and 6.2.x before 6.2.1.1 does not properly implement a logging-obfuscation feature for secure properties, which allows remote authenticated users to obtain sensitive information via vectors involving special characters.

The weakness was presented 07/01/2016 (Website). The advisory is available at www-01.ibm.com. This vulnerability was named CVE-2016-0364 since 12/08/2015. The exploitation appears to be easy. The attack can be initiated remotely. A single authentication is needed for exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1592 by the MITRE ATT&CK project.

Upgrading to version 6.0.1.13, 6.1.3.3 or 6.2.1.1 eliminates this vulnerability.

See VDB-88499 for similar entry. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• IBM

Name

• UrbanCode Deploy

Version

• 6.0.1.0
• 6.0.1.1
• 6.0.1.2
• 6.0.1.3
• 6.0.1.4
• 6.0.1.5
• 6.0.1.6
• 6.0.1.7
• 6.0.1.8
• 6.0.1.9
• 6.0.1.10
• 6.0.1.11
• 6.0.1.12
• 6.1.3.0
• 6.1.3.1
• 6.1.3.2
• 6.2.0
• 6.2.1.0

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion