CVE-2007-4271

2007-08-1821:17:00

CWE-22

[email protected]

web.nvd.nist.gov

cve

2007

4271

ibm

db2

udb

directory traversal

vulnerability

local users

arbitrary files

environment variable

symlink following

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

AI Score

Confidence

Low

EPSS

Percentile

5.1%

JSON

Directory traversal vulnerability in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allows local users to create arbitrary files via a … (dot dot) in an unspecified environment variable, which is appended to “/tmp/” and used as a log file. NOTE: this issue might be related to symlink following.

Affected configurations

NVD

Node

ibmdb2_universal_databaseRange≤8.0fp14

ibmdb2_universal_databaseRange≤9.1fp2

VendorProductVersionCPE
ibmdb2_universal_databasecpe:/a:ibm:db2_universal_database::::
ibmdb2_universal_databasecpe:/a:ibm:db2_universal_database::fp14::