7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
There are multiple vulnerabilities in IBM System Networking Switch Center.
There are multiple vulnerabilities in IBM System Networking Switch Center.
Vulnerability Details
CVE-ID: CVE-2015-7817
Description: IBM System Networking Switch Center could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request to the FileReader.jsp script containing “dot dot” sequences (/…/) to view arbitrary files on the system.
CVSS Base Score: 7.5
CVSS Temporal Score: See <http://exchange.xforce.ibmcloud.com/vulnerabilities/105719> for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVE-ID: CVE-2015-7818
Description: IBM System Networking Switch Center could allow a local unprivileged user to upload a malicious jsp file that would be executed with SYSTEM privileges.
CVSS Base Score: 8.4
CVSS Temporal Score: See <http://exchange.xforce.ibmcloud.com/vulnerabilities/105717> for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
CVE-ID: CVE-2015-7819
Description: IBM System Networking Switch Center could allow a remote attacker to obtain the encrypted credentials of the administrator.
CVSS Base Score: 5.9
CVSS Temporal Score: See <http://exchange.xforce.ibmcloud.com/vulnerabilities/105718> for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVE-ID: CVE-2015-7820
Description: IBM System Networking Switch Center could allow a remote unauthenticated attacker to read any file on the system by sending a specially crafted request to the ZipDownload.jsp script.
CVSS Base Score: 7.5
CVSS Temporal Score: See <http://exchange.xforce.ibmcloud.com/vulnerabilities/105720> for current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
IBM System Networking Switch Center 7.3.1.4.
It is recommended to upgrade IBM System Networking Switch Center to version 7.3.1.5. The install packages for this release can be found on IBM’s Passport Advantage website:
<http://www-01.ibm.com/software/passportadvantage/>
IBM recommends upgrading System Networking Switch Center versions 7.1 and 7.2 to 7.3.1.5.
None.
Related Information
IBM Secure Engineering Web Portal
IBM Product Security Incident Response Blog
Acknowledgement
These vulnerabilities were discovered by Andrea Micalizzi (rgod) working with HP’s Zero Day Initiative.
Change History
23 October 2015: Original Copy Published
Disclaimer
According to the Forum of Incident Response and Security Teams (FIRST), the Common Vulnerability Scoring System (CVSS) is an “industry open standard designed to convey vulnerability severity and help to determine urgency and priority of response.” IBM PROVIDES THE CVSS SCORES “AS IS” WITHOUT WARRANTY OF ANY KIND, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. CUSTOMERS ARE RESPONSIBLE FOR ASSESSING THE IMPACT OF ANY ACTUAL OR POTENTIAL SECURITY VULNERABILITY.