CVE-2014-3085

2014-08-1723:55:06

CWE-78

[email protected]

web.nvd.nist.gov

cve-2014-3085

systest.php

ibm

gcm16

gcm32

global console manager

firmware

remote authenticated users

arbitrary commands

shell metacharacters

lpres parameter

security vulnerability

7.3 High

AI Score

Confidence

Low

7.1 High

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:S/C:C/I:C/A:C

0.004 Low

EPSS

Percentile

72.1%

JSON

systest.php on IBM GCM16 and GCM32 Global Console Manager switches with firmware before 1.20.20.23447 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the lpres parameter.

Affected configurations

NVD

Node

ibmglobal_console_manager_16_firmwareRange≤1.20.0.22575

ibmglobal_console_manager_32_firmwareRange≤1.20.0.22575

CPENameOperatorVersion
ibm:global_console_manager_16_firmwareibm global console manager 16 firmwarele1.20.0.22575
ibm:global_console_manager_32_firmwareibm global console manager 32 firmwarele1.20.0.22575

CPE	Name	Operator	Version
ibm:global_console_manager_16_firmware	ibm global console manager 16 firmware	le	1.20.0.22575
ibm:global_console_manager_32_firmware	ibm global console manager 32 firmware	le	1.20.0.22575