CVE-2015-0146

2015-03-1810:59:00

CWE-264

[email protected]

web.nvd.nist.gov

ibm

content collector

vulnerability

ibm content search services

ibm filenet p8

sensitive information

search query

5.8 Medium

AI Score

Confidence

Low

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

5.2%

JSON

IBM Content Collector for Email 3.0 before 3.0.0.6-IBM-ICC-Server-IF001 and 4.0 before 4.0.0.3-IBM-ICC-Server-IF001 does not properly handle an unspecified query operator during searches of IBM FileNet P8 systems with IBM Content Search Services, which allows local users to bypass intended document-access restrictions and obtain sensitive information via a crafted search query.

CPENameOperatorVersion
ibm:content_collectoribm content collectoreq4.0.0.0
ibm:content_collectoribm content collectoreq4.0.0.2
ibm:content_collectoribm content collectoreq4.0.0.1
ibm:content_collectoribm content collectoreq3.0.0.1
ibm:content_collectoribm content collectoreq3.0.0.4
ibm:content_collectoribm content collectoreq3.0.0.2
ibm:content_collectoribm content collectoreq3.0.0.0
ibm:content_collectoribm content collectoreq3.0.0.3
ibm:content_collectoribm content collectoreq3.0.0.5

CPE	Name	Operator	Version
ibm:content_collector	ibm content collector	eq	4.0.0.0
ibm:content_collector	ibm content collector	eq	4.0.0.2
ibm:content_collector	ibm content collector	eq	4.0.0.1
ibm:content_collector	ibm content collector	eq	3.0.0.1
ibm:content_collector	ibm content collector	eq	3.0.0.4
ibm:content_collector	ibm content collector	eq	3.0.0.2
ibm:content_collector	ibm content collector	eq	3.0.0.0
ibm:content_collector	ibm content collector	eq	3.0.0.3
ibm:content_collector	ibm content collector	eq	3.0.0.5