Security Bulletin: Unauthenticated arbitrary file disclosure in IBM SPSS Collaboration and Deployment Services (CVE-2013-4043)

Summary

A remote, unauthenticated attacker can send a HTTP request to retrieve the content of any file on the IBM SPSS Collaboration and Deployment Service server.

Vulnerability Details

CVEID:_CVE-2013-4043 _
DESCRIPTION:
A remote, unauthenticated attacker can send a HTTP request to retrieve the content of any file on the IBM SPSS Collaboration and Deployment Service server . All users of Collaboration and Deployment Services are vulnerable.

CVSS Base Score: 5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/86419 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

Affected Products and Versions

Collaboration and Deployment Services, version 6.0 and earlier.

Remediation/Fixes

Workarounds and Mitigations

None