Details of VAR-201801-0194

ID

VAR-201801-0194

CVE

CVE-2017-1459

TITLE

IBM Security Access Manager Appliance Access control vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-001327

DESCRIPTION

IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 128378. Vendors have confirmed this vulnerability IBM X-Force ID: 128378 It is released as.Information may be obtained and information may be altered. Multiple IBM products are prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass security restrictions and gain unauthorized access to the vulnerable system; this may aid in launching further attacks. The product enables access management control through integrated appliances for web, mobile and cloud computing. An attacker could exploit this vulnerability to read and change resources

Trust: 1.98

sources: NVD: CVE-2017-1459 // JVNDB: JVNDB-2018-001327 // BID: 102841 // VULHUB: VHN-105327

AFFECTED PRODUCTS

vendor:	ibm	model:	security access manager for mobile	scope:	-	version:	-	Trust: 1.4
vendor:	ibm	model:	security access manager 9.0	scope:	eq	version:	*	Trust: 1.0
vendor:	ibm	model:	security access manager for mobile	scope:	eq	version:	*	Trust: 1.0
vendor:	ibm	model:	security access manager for web 8.0	scope:	eq	version:	*	Trust: 1.0
vendor:	ibm	model:	security access manager for web software	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	security access manager software	scope:	-	version:	-	Trust: 0.8
vendor:	ibm	model:	security access manager 9.0	scope:	-	version:	-	Trust: 0.6
vendor:	ibm	model:	security access manager for web 8.0	scope:	-	version:	-	Trust: 0.6
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	8.0.1.6	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	8.0.1.5	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	8.0.1.4	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	8.0.1.3	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	8.0.1.2	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	8.0.1.1	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	8.0.1.0	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	eq	version:	8.0.0.0	Trust: 0.3
vendor:	ibm	model:	security access manager for mobile	scope:	eq	version:	8.0.1.6	Trust: 0.3
vendor:	ibm	model:	security access manager for mobile	scope:	eq	version:	8.0.1.5	Trust: 0.3
vendor:	ibm	model:	security access manager for mobile	scope:	eq	version:	8.0.1.4	Trust: 0.3
vendor:	ibm	model:	security access manager for mobile	scope:	eq	version:	8.0.1.3	Trust: 0.3
vendor:	ibm	model:	security access manager for mobile	scope:	eq	version:	8.0.1.2	Trust: 0.3
vendor:	ibm	model:	security access manager for mobile	scope:	eq	version:	8.0.1.1	Trust: 0.3
vendor:	ibm	model:	security access manager for mobile	scope:	eq	version:	8.0.0.1	Trust: 0.3
vendor:	ibm	model:	security access manager for mobile	scope:	eq	version:	8.0	Trust: 0.3
vendor:	ibm	model:	security access manager	scope:	eq	version:	9.0.3.1	Trust: 0.3
vendor:	ibm	model:	security access manager	scope:	eq	version:	9.0.3.0	Trust: 0.3
vendor:	ibm	model:	security access manager	scope:	eq	version:	9.0.2.0	Trust: 0.3
vendor:	ibm	model:	security access manager	scope:	eq	version:	9.0.1.0	Trust: 0.3
vendor:	ibm	model:	security access manager	scope:	eq	version:	9.0.0.1	Trust: 0.3
vendor:	ibm	model:	security access manager	scope:	eq	version:	9.0	Trust: 0.3
vendor:	ibm	model:	security access manager for web	scope:	ne	version:	8.0.1.7	Trust: 0.3
vendor:	ibm	model:	security access manager for mobile	scope:	ne	version:	8.0.1.7	Trust: 0.3
vendor:	ibm	model:	security access manager	scope:	ne	version:	9.0.4.0	Trust: 0.3

sources: BID: 102841 // JVNDB: JVNDB-2018-001327 // CNNVD: CNNVD-201801-380 // NVD: CVE-2017-1459

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-1459
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-1459
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201801-380
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-105327
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-1459
severity:	MEDIUM
baseScore:	4.9
vectorString:	AV:N/AC:M/AU:S/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-105327
severity:	MEDIUM
baseScore:	4.9
vectorString:	AV:N/AC:M/AU:S/C:P/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	SINGLE
confidentialityImpact:	PARTIAL
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	6.8
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-1459
baseSeverity:	MEDIUM
baseScore:	4.2
vectorString:	CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	HIGH
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	1.6
impactScore:	2.5
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-105327 // JVNDB: JVNDB-2018-001327 // CNNVD: CNNVD-201801-380 // NVD: CVE-2017-1459

PROBLEMTYPE DATA

problemtype:	CWE-732	Trust: 1.1
problemtype:	CWE-284	Trust: 0.9

sources: VULHUB: VHN-105327 // JVNDB: JVNDB-2018-001327 // NVD: CVE-2017-1459

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201801-380

TYPE

lack of information

Trust: 0.6

sources: CNNVD: CNNVD-201801-380

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-001327

PATCH

title:	2012331	url:	http://www-01.ibm.com/support/docview.wss?uid=swg22012331	Trust: 0.8
title:	IBM Security Access Manager Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=77636	Trust: 0.6

sources: JVNDB: JVNDB-2018-001327 // CNNVD: CNNVD-201801-380

EXTERNAL IDS

db:	NVD	id:	CVE-2017-1459	Trust: 2.8
db:	SECTRACK	id:	1040170	Trust: 1.7
db:	JVNDB	id:	JVNDB-2018-001327	Trust: 0.8
db:	CNNVD	id:	CNNVD-201801-380	Trust: 0.7
db:	BID	id:	102841	Trust: 0.4
db:	VULHUB	id:	VHN-105327	Trust: 0.1

sources: VULHUB: VHN-105327 // BID: 102841 // JVNDB: JVNDB-2018-001327 // CNNVD: CNNVD-201801-380 // NVD: CVE-2017-1459

REFERENCES

url:	http://www.ibm.com/support/docview.wss?uid=swg22012331	Trust: 1.7
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/128378	Trust: 1.7
url:	http://www.securitytracker.com/id/1040170	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-1459	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-1459	Trust: 0.8
url:	http://www.ibm.com/	Trust: 0.3
url:	http://www-01.ibm.com/support/docview.wss?uid=swg22012331	Trust: 0.3

sources: VULHUB: VHN-105327 // BID: 102841 // JVNDB: JVNDB-2018-001327 // CNNVD: CNNVD-201801-380 // NVD: CVE-2017-1459

CREDITS

IBM X-Force Ethical Hacking Team: Ron Craig, Warren Moynihan, Jonathan Fitz-Gerald, John Zuccato, Rodney Ryan, Chris Shepherd, Dmitriy Beryoza

Trust: 0.3

sources: BID: 102841

SOURCES

db:	VULHUB	id:	VHN-105327
db:	BID	id:	102841
db:	JVNDB	id:	JVNDB-2018-001327
db:	CNNVD	id:	CNNVD-201801-380
db:	NVD	id:	CVE-2017-1459

LAST UPDATE DATE

2024-11-23T22:52:14.399000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-105327	date:	2020-10-27T00:00:00
db:	BID	id:	102841	date:	2018-01-05T00:00:00
db:	JVNDB	id:	JVNDB-2018-001327	date:	2018-02-08T00:00:00
db:	CNNVD	id:	CNNVD-201801-380	date:	2019-10-23T00:00:00
db:	NVD	id:	CVE-2017-1459	date:	2024-11-21T03:21:54.620

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-105327	date:	2018-01-10T00:00:00
db:	BID	id:	102841	date:	2018-01-05T00:00:00
db:	JVNDB	id:	JVNDB-2018-001327	date:	2018-02-08T00:00:00
db:	CNNVD	id:	CNNVD-201801-380	date:	2018-01-11T00:00:00
db:	NVD	id:	CVE-2017-1459	date:	2018-01-10T17:29:00.750