CVE-2015-7425

Опубликовано: 21 фев. 2016

Источник: nvd

CVSS3: 10

CVSS2: 10

EPSS Низкий

Описание

The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments: Data Protection for VMware (aka Spectrum Protect for Virtual Environments) 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.4 and Tivoli Storage FlashCopy Manager for VMware (aka Spectrum Protect Snapshot) 3.1 before 3.1.1.3, 3.2 before 3.2.0.6, and 4.1 before 4.1.4 allows remote attackers to obtain administrative privileges via a crafted URL that triggers back-end function execution.

Ссылки

http://www-01.ibm.com/support/docview.wss?uid=swg21973086
Vendor Advisory
http://www.securityfocus.com/bid/79545
http://www-01.ibm.com/support/docview.wss?uid=swg21973086
Vendor Advisory
http://www.securityfocus.com/bid/79545

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:3.1:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:3.1.1:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:3.2:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:6.3:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:6.4:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:6.4.2:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_flashcopy_manager_for_vmware:6.4.3:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:4.1.0:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:4.1.1:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:4.1.2:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:4.1.3:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:6.3.1:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:6.3.2:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:6.4.1:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:7.1.0:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:7.1.1:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:7.1.2:*:*:*:*:vmware:*:*

cpe:2.3:a:ibm:tivoli_storage_manager_for_virtual_environments_data_protection_for_vmware:7.1.3:*:*:*:*:vmware:*:*

EPSS

Процентиль: 93%

0.09884

Низкий

10 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-65jh-q77m-pwj8

CVSS3: 10

github

больше 3 лет назад

BDU:2016-00892

fstec

почти 10 лет назад

Уязвимость средства резервирования данных и приложений IBM Spectrum Protect Snapshot и средства защиты виртуальных машин IBM Spectrum Protect for Virtual Environments, позволяющая нарушителю повысить свои привилегии

EPSS

Процентиль: 93%

0.09884

Низкий

10 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-264