Lucene search

K
ibmIBM9209CA54A0A6D36B7CC32191CCFD17C389F41528924D698986F497F467C293A7
HistoryJul 06, 2022 - 5:35 a.m.

Security Bulletin: A security vulnerability has been identified in Apache Subversion shipped with IBM Tivoli Netcool Impact (CVE-2021-28544)

2022-07-0605:35:34
www.ibm.com
12

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

67.9%

Summary

Apache Subversion is shipped with IBM Tivoli Netcool Impact. Information about a security vulnerability affecting Apache Subversion has been published in a security bulletin.

Vulnerability Details

CVEID:CVE-2021-28544
**DESCRIPTION:**Apache Subversion could allow a remote authenticated attacker to obtain sensitive information, caused by a flaw in the configured path-based authorization (authz) rules. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain the “copyfrom” paths information, and use this information to launch further attacks against the affected system.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/224010 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Tivoli Netcool Impact 7.1.0

Remediation/Fixes

Product VRMF APAR Remediation
IBM Tivoli Netcool Impact 7.1.0 7.1.0.26 IJ39754 Upgrade to IBM Tivoli Netcool Impact 7.1.0 FP26

Workarounds and Mitigations

None

CPENameOperatorVersion
tivoli netcool/impacteq7.1.0

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

3.5 Low

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

67.9%