CVE-2015-5020

The Big SQL component in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0 allows remote authenticated users to bypass intended access restrictions and truncate arbitrary tables via unspecified vectors.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:P/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21967923	Vendor Advisory
http://www.securitytracker.com/id/1034561

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:infosphere_biginsights:3.0.0.0:::::::*
	cpe:2.3:a:ibm:infosphere_biginsights:3.0.0.1:::::::*
	cpe:2.3:a:ibm:infosphere_biginsights:3.0.0.2:::::::*
	cpe:2.3:a:ibm:infosphere_biginsights:4.0.0.0:::::::*

History

No history.

Information

Published : 2016-01-02 05:59

Updated : 2016-12-07 18:15

NVD link : CVE-2015-5020

Mitre link : CVE-2015-5020

CVE.ORG link : CVE-2015-5020

JSON object : View

Products Affected

ibm

infosphere_biginsights

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2015-5020", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2016-01-02T05:59:04.753", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21967923", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securitytracker.com/id/1034561", "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The Big SQL component in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0 allows remote authenticated users to bypass intended access restrictions and truncate arbitrary tables via unspecified vectors."}, {"lang": "es", "value": "El componente Big SQL en IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2 y 4.0 permite a usuarios remotos autenticados eludir las restricciones destinadas al acceso y truncar tablas arbitrarias a trav\u00e9s de vectores no especificados."}], "lastModified": "2016-12-07T18:15:38.670", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:infosphere_biginsights:3.0.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "31342AF9-D73E-4B72-A98D-00E33A7088C1"}, {"criteria": "cpe:2.3:a:ibm:infosphere_biginsights:3.0.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6771B5C2-7291-4A8F-A558-679768838EAE"}, {"criteria": "cpe:2.3:a:ibm:infosphere_biginsights:3.0.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1875306C-CF9A-423D-9786-B880A5EAD2DB"}, {"criteria": "cpe:2.3:a:ibm:infosphere_biginsights:4.0.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D13EADA0-0A9D-4D91-9625-73A2F6792B62"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}