IBM Tivoli Application Dependency Discovery Manager 7.2.2/7.3 File information disclosure

Summaryinfo

A vulnerability labeled as problematic has been found in IBM Tivoli Application Dependency Discovery Manager 7.2.2/7.3. This vulnerability affects unknown code. Such manipulation leads to information disclosure (File). This vulnerability is uniquely identified as CVE-2016-8926. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability was found in IBM Tivoli Application Dependency Discovery Manager 7.2.2/7.3 (Directory Service Software). It has been rated as problematic. Affected by this issue is an unknown part. The manipulation with an unknown input leads to a information disclosure vulnerability (File). Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. CVE summarizes:

IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 could allow a remote attacker to read system files or data that is restricted to authorized users. IBM X-Force ID: 118539.

The bug was discovered 04/12/2017. The weakness was disclosed 04/14/2017 (Website). The advisory is shared for download at ibm.com. This vulnerability is handled as CVE-2016-8926 since 10/25/2016. The exploitation is known to be easy. The attack may be launched remotely. A simple authentication is necessary for exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/31/2020). It is expected to see the exploit prices for this product increasing in the near future.The MITRE ATT&CK project declares the attack technique as T1592.

The vulnerability was handled as a non-public zero-day exploit for at least 2 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-99871 and VDB-99873 are pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Directory Service Software

Vendor

• IBM

Name

• Tivoli Application Dependency Discovery Manager

Version

• 7.2.2
• 7.3

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion