Lucene search

K
ibmIBM927C9B4CFDDDC114B01F4D59BD188132BC0133966143A780793465849F86A3AE
HistorySep 30, 2021 - 5:38 p.m.

Security Bulletin: IBM Security SiteProtector System is affected by Apache HTTP Server vulnerabilities (CVE-2020-13938, CVE-2021-30641)

2021-09-3017:38:21
www.ibm.com
6

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.014 Low

EPSS

Percentile

84.6%

Summary

IBM Security SiteProtector System has addressed the following vulnerabilities in Apache HTTP Server.

Vulnerability Details

CVEID:CVE-2020-13938
**DESCRIPTION:**Apache HTTP Server is vulnerable to a denial of service, caused by the improper handling of insufficient privileges. A local attacker could exploit this vulnerability to stop httpd on Windows, resulting in a denial of service.
CVSS Base score: 6.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/203460 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2021-30641
**DESCRIPTION:**Apache HTTP Server could provide weaker than expected security, caused by unexpected URL matching behavior with 'MergeSlashes OFF. An attacker could exploit this vulnerability to match URLs from all sites in the same domain and launch further attacks on the system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/203459 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Security SiteProtector System 3.0.0
IBM Security SiteProtector System 3.1.1

Remediation/Fixes

Product VRMF Remediation/First Fix
IBM Security SiteProtector System 3.1.1 Apply the appropriate eXPress Updates (XPUs) as identified in the SiteProtector Console Agent view: UpdateServer_3_1_1_16.pkg
IBM Security SiteProtector System 3.0.0

3.0.0 is no longer supported. Apply the appropriate eXPress Updates (XPUs) as identified in the SiteProtector Console Agent view:

UpdateServer_3_1_1_16.pkg

Workarounds and Mitigations

None

CPENameOperatorVersion
ibm security siteprotector systemeqany

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.014 Low

EPSS

Percentile

84.6%

Related for 927C9B4CFDDDC114B01F4D59BD188132BC0133966143A780793465849F86A3AE