CVE-2016-0373

CVSS v3 3.1 LOW
CVSS v2.0 4.0 MEDIUM

3.1^/10

CVSS v3 : LOW

Vector : AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

I

BM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119.

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg2C1000219	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/112119	VDB Entry Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg2C1000219	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/112119	VDB Entry Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ibm:urbancode_deploy:*:*:*:*:*:*:*:*

History

21 Nov 2024, 02:41

Type	Values Removed	Values Added
CVSS	v2 : ~~4.0~~ v3 : ~~4.3~~	v2 : 4.0 v3 : 3.1
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg2C1000219 - Patch, Vendor Advisory~~	() http://www-01.ibm.com/support/docview.wss?uid=swg2C1000219 - Patch, Vendor Advisory
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/112119 - VDB Entry, Vendor Advisory~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/112119 - VDB Entry, Vendor Advisory

Information

Published : 2018-08-30 16:29

Updated : 2024-11-21 02:41

NVD link : CVE-2016-0373

Mitre link : CVE-2016-0373

CVE.ORG link : CVE-2016-0373

JSON object : View

Products Affected

urbancode_deploy

CWE

CWE-285

Improper Authorization

{"id": "CVE-2016-0373", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "[email protected]", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2018-08-30T16:29:00.557", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg2C1000219", "tags": ["Patch", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/112119", "tags": ["VDB Entry", "Vendor Advisory"], "source": "[email protected]"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg2C1000219", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/112119", "tags": ["VDB Entry", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119."}, {"lang": "es", "value": "IBM UrbanCode Deploy, desde la versi\u00f3n 6.0 hasta la 6.2.2.1 podr\u00eda permitir que un usuario autenticado lea informaci\u00f3n sensible debido a que los endpoints UCD REST no autorizan debidamente a los usuarios al determinar qui\u00e9n puede leer datos. IBM X-Force ID: 112119."}], "lastModified": "2024-11-21T02:41:34.867", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:urbancode_deploy:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "82634693-BA46-4AEA-861B-767C21445FF2", "versionEndIncluding": "6.2.2.1", "versionStartIncluding": "6.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}