From 0605ffa88598275358673f4b4679e7b3f23843bc Mon Sep 17 00:00:00 2001 From: Scott Moore - IBM Date: Thu, 21 Feb 2019 11:07:16 -0500 Subject: [PATCH] IBM20190221-11716 Added CVE-2018-1945, CVE-2018-2006, CVE-2018-1944, CVE-2018-1946, CVE-2018-1947, CVE-2018-1950, CVE-2018-1948, CVE-2018-1949 --- 2018/1xxx/CVE-2018-1944.json | 116 +++++++++++++++++++++++++++++++--- 2018/1xxx/CVE-2018-1945.json | 118 +++++++++++++++++++++++++++++++---- 2018/1xxx/CVE-2018-1946.json | 114 ++++++++++++++++++++++++++++++--- 2018/1xxx/CVE-2018-1947.json | 108 ++++++++++++++++++++++++++++++-- 2018/1xxx/CVE-2018-1948.json | 108 ++++++++++++++++++++++++++++++-- 2018/1xxx/CVE-2018-1949.json | 108 ++++++++++++++++++++++++++++++-- 2018/1xxx/CVE-2018-1950.json | 118 +++++++++++++++++++++++++++++++---- 2018/2xxx/CVE-2018-2006.json | 86 ++++++++++++++++++++++--- 8 files changed, 810 insertions(+), 66 deletions(-) diff --git a/2018/1xxx/CVE-2018-1944.json b/2018/1xxx/CVE-2018-1944.json index d50dd548f2a..25b512aff58 100644 --- a/2018/1xxx/CVE-2018-1944.json +++ b/2018/1xxx/CVE-2018-1944.json @@ -1,18 +1,114 @@ { - "CVE_data_meta" : { - "ASSIGNER" : "cve@mitre.org", - "ID" : "CVE-2018-1944", - "STATE" : "RESERVED" - }, - "data_format" : "MITRE", - "data_type" : "CVE", - "data_version" : "4.0", "description" : { "description_data" : [ { "lang" : "eng", - "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value" : "IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 153386." } ] - } + }, + "CVE_data_meta" : { + "DATE_PUBLIC" : "2019-02-18T00:00:00", + "STATE" : "PUBLIC", + "ID" : "CVE-2018-1944", + "ASSIGNER" : "psirt@us.ibm.com" + }, + "references" : { + "reference_data" : [ + { + "name" : "https://www.ibm.com/support/docview.wss?uid=ibm10872142", + "url" : "https://www.ibm.com/support/docview.wss?uid=ibm10872142", + "refsource" : "CONFIRM", + "title" : "IBM Security Bulletin 0872142 (Security Identity Governance and Intelligence)" + }, + { + "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/153386", + "refsource" : "XF", + "title" : "X-Force Vulnerability Report", + "name" : "ibm-sig-cve20181944-info-disc (153386)" + } + ] + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "vendor_name" : "IBM", + "product" : { + "product_data" : [ + { + "product_name" : "Security Identity Governance and Intelligence", + "version" : { + "version_data" : [ + { + "version_value" : "5.2" + }, + { + "version_value" : "5.2.1" + }, + { + "version_value" : "5.2.2" + }, + { + "version_value" : "5.2.2.1" + }, + { + "version_value" : "5.2.3" + }, + { + "version_value" : "5.2.3.1" + }, + { + "version_value" : "5.2.3.2" + }, + { + "version_value" : "5.2.4" + }, + { + "version_value" : "5.2.4.1" + } + ] + } + } + ] + } + } + ] + } + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "Obtain Information" + } + ] + } + ] + }, + "data_format" : "MITRE", + "data_type" : "CVE", + "impact" : { + "cvssv3" : { + "BM" : { + "S" : "U", + "AC" : "H", + "PR" : "N", + "I" : "N", + "AV" : "L", + "SCORE" : "5.100", + "UI" : "N", + "A" : "N", + "C" : "H" + }, + "TM" : { + "E" : "U", + "RL" : "O", + "RC" : "C" + } + } + }, + "data_version" : "4.0" } diff --git a/2018/1xxx/CVE-2018-1945.json b/2018/1xxx/CVE-2018-1945.json index 29cab81d75f..4f13abebf33 100644 --- a/2018/1xxx/CVE-2018-1945.json +++ b/2018/1xxx/CVE-2018-1945.json @@ -1,18 +1,114 @@ { - "CVE_data_meta" : { - "ASSIGNER" : "cve@mitre.org", - "ID" : "CVE-2018-1945", - "STATE" : "RESERVED" - }, - "data_format" : "MITRE", - "data_type" : "CVE", - "data_version" : "4.0", "description" : { "description_data" : [ { - "lang" : "eng", - "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value" : "IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against the victim. IBM X-Force ID: 153387.", + "lang" : "eng" } ] - } + }, + "CVE_data_meta" : { + "ASSIGNER" : "psirt@us.ibm.com", + "ID" : "CVE-2018-1945", + "DATE_PUBLIC" : "2019-02-18T00:00:00", + "STATE" : "PUBLIC" + }, + "references" : { + "reference_data" : [ + { + "url" : "https://www.ibm.com/support/docview.wss?uid=ibm10872142", + "refsource" : "CONFIRM", + "title" : "IBM Security Bulletin 0872142 (Security Identity Governance and Intelligence)", + "name" : "https://www.ibm.com/support/docview.wss?uid=ibm10872142" + }, + { + "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/153387", + "title" : "X-Force Vulnerability Report", + "refsource" : "XF", + "name" : "ibm-sig-cve20181945-clickjacking (153387)" + } + ] + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "product_name" : "Security Identity Governance and Intelligence", + "version" : { + "version_data" : [ + { + "version_value" : "5.2" + }, + { + "version_value" : "5.2.1" + }, + { + "version_value" : "5.2.2" + }, + { + "version_value" : "5.2.2.1" + }, + { + "version_value" : "5.2.3" + }, + { + "version_value" : "5.2.3.1" + }, + { + "version_value" : "5.2.3.2" + }, + { + "version_value" : "5.2.4" + }, + { + "version_value" : "5.2.4.1" + } + ] + } + } + ] + }, + "vendor_name" : "IBM" + } + ] + } + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "Gain Access" + } + ] + } + ] + }, + "data_format" : "MITRE", + "data_type" : "CVE", + "impact" : { + "cvssv3" : { + "TM" : { + "RC" : "C", + "RL" : "O", + "E" : "U" + }, + "BM" : { + "UI" : "R", + "SCORE" : "6.100", + "C" : "L", + "A" : "N", + "I" : "L", + "PR" : "N", + "AV" : "N", + "AC" : "L", + "S" : "C" + } + } + }, + "data_version" : "4.0" } diff --git a/2018/1xxx/CVE-2018-1946.json b/2018/1xxx/CVE-2018-1946.json index d62b6823d60..33dc5db0065 100644 --- a/2018/1xxx/CVE-2018-1946.json +++ b/2018/1xxx/CVE-2018-1946.json @@ -1,18 +1,114 @@ { - "CVE_data_meta" : { - "ASSIGNER" : "cve@mitre.org", - "ID" : "CVE-2018-1946", - "STATE" : "RESERVED" + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "vendor_name" : "IBM", + "product" : { + "product_data" : [ + { + "product_name" : "Security Identity Governance and Intelligence", + "version" : { + "version_data" : [ + { + "version_value" : "5.2" + }, + { + "version_value" : "5.2.1" + }, + { + "version_value" : "5.2.2" + }, + { + "version_value" : "5.2.2.1" + }, + { + "version_value" : "5.2.3" + }, + { + "version_value" : "5.2.3.1" + }, + { + "version_value" : "5.2.3.2" + }, + { + "version_value" : "5.2.4" + }, + { + "version_value" : "5.2.4.1" + } + ] + } + } + ] + } + } + ] + } + }, + "references" : { + "reference_data" : [ + { + "refsource" : "CONFIRM", + "title" : "IBM Security Bulletin 0872142 (Security Identity Governance and Intelligence)", + "url" : "https://www.ibm.com/support/docview.wss?uid=ibm10872142", + "name" : "https://www.ibm.com/support/docview.wss?uid=ibm10872142" + }, + { + "name" : "ibm-sig-cve20181946-info-disc (153388)", + "title" : "X-Force Vulnerability Report", + "refsource" : "XF", + "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/153388" + } + ] + }, + "CVE_data_meta" : { + "ASSIGNER" : "psirt@us.ibm.com", + "ID" : "CVE-2018-1946", + "STATE" : "PUBLIC", + "DATE_PUBLIC" : "2019-02-18T00:00:00" }, - "data_format" : "MITRE", - "data_type" : "CVE", - "data_version" : "4.0", "description" : { "description_data" : [ { "lang" : "eng", - "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value" : "IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. IBM X-Force ID: 153388." } ] - } + }, + "data_version" : "4.0", + "data_type" : "CVE", + "impact" : { + "cvssv3" : { + "TM" : { + "RL" : "O", + "E" : "U", + "RC" : "C" + }, + "BM" : { + "S" : "U", + "AC" : "H", + "SCORE" : "5.900", + "UI" : "N", + "C" : "H", + "A" : "N", + "PR" : "N", + "I" : "N", + "AV" : "N" + } + } + }, + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "Obtain Information" + } + ] + } + ] + }, + "data_format" : "MITRE" } diff --git a/2018/1xxx/CVE-2018-1947.json b/2018/1xxx/CVE-2018-1947.json index 7cea464b737..05c61dbfc79 100644 --- a/2018/1xxx/CVE-2018-1947.json +++ b/2018/1xxx/CVE-2018-1947.json @@ -1,17 +1,113 @@ { - "CVE_data_meta" : { - "ASSIGNER" : "cve@mitre.org", - "ID" : "CVE-2018-1947", - "STATE" : "RESERVED" - }, "data_format" : "MITRE", + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "value" : "Cross-Site Scripting", + "lang" : "eng" + } + ] + } + ] + }, "data_type" : "CVE", + "impact" : { + "cvssv3" : { + "TM" : { + "RC" : "C", + "RL" : "O", + "E" : "H" + }, + "BM" : { + "S" : "C", + "AC" : "L", + "A" : "N", + "C" : "L", + "SCORE" : "6.100", + "UI" : "R", + "AV" : "N", + "PR" : "N", + "I" : "L" + } + } + }, "data_version" : "4.0", "description" : { "description_data" : [ { "lang" : "eng", - "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value" : "IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 153427." + } + ] + }, + "CVE_data_meta" : { + "ASSIGNER" : "psirt@us.ibm.com", + "ID" : "CVE-2018-1947", + "DATE_PUBLIC" : "2019-02-18T00:00:00", + "STATE" : "PUBLIC" + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "vendor_name" : "IBM", + "product" : { + "product_data" : [ + { + "version" : { + "version_data" : [ + { + "version_value" : "5.2" + }, + { + "version_value" : "5.2.1" + }, + { + "version_value" : "5.2.2" + }, + { + "version_value" : "5.2.2.1" + }, + { + "version_value" : "5.2.3" + }, + { + "version_value" : "5.2.3.1" + }, + { + "version_value" : "5.2.3.2" + }, + { + "version_value" : "5.2.4" + }, + { + "version_value" : "5.2.4.1" + } + ] + }, + "product_name" : "Security Identity Governance and Intelligence" + } + ] + } + } + ] + } + }, + "references" : { + "reference_data" : [ + { + "name" : "https://www.ibm.com/support/docview.wss?uid=ibm10872142", + "title" : "IBM Security Bulletin 0872142 (Security Identity Governance and Intelligence)", + "refsource" : "CONFIRM", + "url" : "https://www.ibm.com/support/docview.wss?uid=ibm10872142" + }, + { + "name" : "ibm-sig-cve20181947-xss (153427)", + "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/153427", + "refsource" : "XF", + "title" : "X-Force Vulnerability Report" } ] } diff --git a/2018/1xxx/CVE-2018-1948.json b/2018/1xxx/CVE-2018-1948.json index 19caee84923..398996aa3a6 100644 --- a/2018/1xxx/CVE-2018-1948.json +++ b/2018/1xxx/CVE-2018-1948.json @@ -1,18 +1,114 @@ { - "CVE_data_meta" : { - "ASSIGNER" : "cve@mitre.org", - "ID" : "CVE-2018-1948", - "STATE" : "RESERVED" - }, "data_format" : "MITRE", + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "Obtain Information" + } + ] + } + ] + }, "data_type" : "CVE", + "impact" : { + "cvssv3" : { + "BM" : { + "S" : "U", + "AC" : "L", + "C" : "L", + "A" : "N", + "SCORE" : "4.300", + "UI" : "R", + "AV" : "N", + "PR" : "N", + "I" : "N" + }, + "TM" : { + "E" : "U", + "RL" : "O", + "RC" : "C" + } + } + }, "data_version" : "4.0", "description" : { "description_data" : [ { "lang" : "eng", - "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value" : "IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 153428." } ] + }, + "CVE_data_meta" : { + "ASSIGNER" : "psirt@us.ibm.com", + "ID" : "CVE-2018-1948", + "STATE" : "PUBLIC", + "DATE_PUBLIC" : "2019-02-18T00:00:00" + }, + "references" : { + "reference_data" : [ + { + "title" : "IBM Security Bulletin 0872142 (Security Identity Governance and Intelligence)", + "refsource" : "CONFIRM", + "url" : "https://www.ibm.com/support/docview.wss?uid=ibm10872142", + "name" : "https://www.ibm.com/support/docview.wss?uid=ibm10872142" + }, + { + "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/153428", + "refsource" : "XF", + "title" : "X-Force Vulnerability Report", + "name" : "ibm-sig-cve20181948-info-disc (153428)" + } + ] + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "vendor_name" : "IBM", + "product" : { + "product_data" : [ + { + "version" : { + "version_data" : [ + { + "version_value" : "5.2" + }, + { + "version_value" : "5.2.1" + }, + { + "version_value" : "5.2.2" + }, + { + "version_value" : "5.2.2.1" + }, + { + "version_value" : "5.2.3" + }, + { + "version_value" : "5.2.3.1" + }, + { + "version_value" : "5.2.3.2" + }, + { + "version_value" : "5.2.4" + }, + { + "version_value" : "5.2.4.1" + } + ] + }, + "product_name" : "Security Identity Governance and Intelligence" + } + ] + } + } + ] + } } } diff --git a/2018/1xxx/CVE-2018-1949.json b/2018/1xxx/CVE-2018-1949.json index 92c597d6b28..f08f462a2c4 100644 --- a/2018/1xxx/CVE-2018-1949.json +++ b/2018/1xxx/CVE-2018-1949.json @@ -1,18 +1,114 @@ { - "CVE_data_meta" : { - "ASSIGNER" : "cve@mitre.org", - "ID" : "CVE-2018-1949", - "STATE" : "RESERVED" + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "value" : "Obtain Information", + "lang" : "eng" + } + ] + } + ] }, "data_format" : "MITRE", "data_type" : "CVE", + "impact" : { + "cvssv3" : { + "BM" : { + "PR" : "L", + "I" : "N", + "AV" : "N", + "SCORE" : "4.300", + "UI" : "N", + "A" : "N", + "C" : "L", + "S" : "U", + "AC" : "L" + }, + "TM" : { + "E" : "U", + "RL" : "O", + "RC" : "C" + } + } + }, "data_version" : "4.0", "description" : { "description_data" : [ { - "lang" : "eng", - "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value" : "IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance discloses sensitive information to unauthorized users. The information can be used to mount further attacks on the system. IBM X-Force ID: 153429.", + "lang" : "eng" } ] + }, + "CVE_data_meta" : { + "DATE_PUBLIC" : "2019-02-18T00:00:00", + "STATE" : "PUBLIC", + "ID" : "CVE-2018-1949", + "ASSIGNER" : "psirt@us.ibm.com" + }, + "references" : { + "reference_data" : [ + { + "name" : "https://www.ibm.com/support/docview.wss?uid=ibm10872142", + "refsource" : "CONFIRM", + "title" : "IBM Security Bulletin 0872142 (Security Identity Governance and Intelligence)", + "url" : "https://www.ibm.com/support/docview.wss?uid=ibm10872142" + }, + { + "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/153429", + "refsource" : "XF", + "title" : "X-Force Vulnerability Report", + "name" : "ibm-sig-cve20181949-info-disc (153429)" + } + ] + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "vendor_name" : "IBM", + "product" : { + "product_data" : [ + { + "product_name" : "Security Identity Governance and Intelligence", + "version" : { + "version_data" : [ + { + "version_value" : "5.2" + }, + { + "version_value" : "5.2.1" + }, + { + "version_value" : "5.2.2" + }, + { + "version_value" : "5.2.2.1" + }, + { + "version_value" : "5.2.3" + }, + { + "version_value" : "5.2.3.1" + }, + { + "version_value" : "5.2.3.2" + }, + { + "version_value" : "5.2.4" + }, + { + "version_value" : "5.2.4.1" + } + ] + } + } + ] + } + } + ] + } } } diff --git a/2018/1xxx/CVE-2018-1950.json b/2018/1xxx/CVE-2018-1950.json index dd9a7e16237..8a2ce45e8b4 100644 --- a/2018/1xxx/CVE-2018-1950.json +++ b/2018/1xxx/CVE-2018-1950.json @@ -1,18 +1,114 @@ { - "CVE_data_meta" : { - "ASSIGNER" : "cve@mitre.org", - "ID" : "CVE-2018-1950", - "STATE" : "RESERVED" - }, - "data_format" : "MITRE", - "data_type" : "CVE", - "data_version" : "4.0", "description" : { "description_data" : [ { - "lang" : "eng", - "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value" : "IBM Security Identity Governance and Intelligence 5.2 through 5.2.4.1 Virtual Appliance generates an error message that includes sensitive information about its environment, users, or associated data which could be used in further attacks against the system. IBM X-Force ID: 153430.", + "lang" : "eng" } ] - } + }, + "CVE_data_meta" : { + "ID" : "CVE-2018-1950", + "ASSIGNER" : "psirt@us.ibm.com", + "STATE" : "PUBLIC", + "DATE_PUBLIC" : "2019-02-18T00:00:00" + }, + "references" : { + "reference_data" : [ + { + "url" : "https://www.ibm.com/support/docview.wss?uid=ibm10872142", + "title" : "IBM Security Bulletin 0872142 (Security Identity Governance and Intelligence)", + "refsource" : "CONFIRM", + "name" : "https://www.ibm.com/support/docview.wss?uid=ibm10872142" + }, + { + "title" : "X-Force Vulnerability Report", + "refsource" : "XF", + "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/153430", + "name" : "ibm-sig-cve20181950-info-disc (153430)" + } + ] + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "product" : { + "product_data" : [ + { + "version" : { + "version_data" : [ + { + "version_value" : "5.2" + }, + { + "version_value" : "5.2.1" + }, + { + "version_value" : "5.2.2" + }, + { + "version_value" : "5.2.2.1" + }, + { + "version_value" : "5.2.3" + }, + { + "version_value" : "5.2.3.1" + }, + { + "version_value" : "5.2.3.2" + }, + { + "version_value" : "5.2.4" + }, + { + "version_value" : "5.2.4.1" + } + ] + }, + "product_name" : "Security Identity Governance and Intelligence" + } + ] + }, + "vendor_name" : "IBM" + } + ] + } + }, + "data_format" : "MITRE", + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "lang" : "eng", + "value" : "Obtain Information" + } + ] + } + ] + }, + "data_type" : "CVE", + "impact" : { + "cvssv3" : { + "TM" : { + "E" : "U", + "RL" : "O", + "RC" : "C" + }, + "BM" : { + "UI" : "N", + "SCORE" : "4.300", + "C" : "L", + "A" : "N", + "I" : "N", + "PR" : "L", + "AV" : "N", + "AC" : "L", + "S" : "U" + } + } + }, + "data_version" : "4.0" } diff --git a/2018/2xxx/CVE-2018-2006.json b/2018/2xxx/CVE-2018-2006.json index 9d12031e3aa..67be30e0189 100644 --- a/2018/2xxx/CVE-2018-2006.json +++ b/2018/2xxx/CVE-2018-2006.json @@ -1,18 +1,90 @@ { "CVE_data_meta" : { - "ASSIGNER" : "cve@mitre.org", "ID" : "CVE-2018-2006", - "STATE" : "RESERVED" + "ASSIGNER" : "psirt@us.ibm.com", + "STATE" : "PUBLIC", + "DATE_PUBLIC" : "2019-02-19T00:00:00" + }, + "references" : { + "reference_data" : [ + { + "title" : "IBM Security Bulletin 794133 (Robotic Process Automation with Automation Anywhere)", + "refsource" : "CONFIRM", + "url" : "https://www.ibm.com/support/docview.wss?uid=ibm10794133", + "name" : "https://www.ibm.com/support/docview.wss?uid=ibm10794133" + }, + { + "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/155008", + "refsource" : "XF", + "title" : "X-Force Vulnerability Report", + "name" : "ibm-rpa-cve20182006-dir-traversal (155008)" + } + ] + }, + "affects" : { + "vendor" : { + "vendor_data" : [ + { + "vendor_name" : "IBM", + "product" : { + "product_data" : [ + { + "version" : { + "version_data" : [ + { + "version_value" : "11" + } + ] + }, + "product_name" : "Robotic Process Automation with Automation Anywhere" + } + ] + } + } + ] + } }, - "data_format" : "MITRE", - "data_type" : "CVE", - "data_version" : "4.0", "description" : { "description_data" : [ { "lang" : "eng", - "value" : "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided." + "value" : "IBM Robotic Process Automation with Automation Anywhere 11 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing \"dot dot\" sequences (/../) to upload arbitrary files to the system. IBM X-Force ID: 155008." } ] - } + }, + "data_version" : "4.0", + "data_format" : "MITRE", + "problemtype" : { + "problemtype_data" : [ + { + "description" : [ + { + "value" : "File Manipulation", + "lang" : "eng" + } + ] + } + ] + }, + "impact" : { + "cvssv3" : { + "TM" : { + "E" : "U", + "RL" : "O", + "RC" : "C" + }, + "BM" : { + "AC" : "L", + "S" : "U", + "UI" : "N", + "SCORE" : "4.900", + "A" : "N", + "C" : "N", + "I" : "H", + "PR" : "H", + "AV" : "N" + } + } + }, + "data_type" : "CVE" }