cnvd - cnvd-2015-04439

CNVD-2015-04439

Vulnerability from cnvd - Published: 2015-07-14

Title

IBM InfoSphere Master Data Management信息泄露漏洞（CNVD-2015-04439）

Description

IBM InfoSphere Master Data Management（MDM）是美国IBM公司的一套用于帮助组织管理整个企业范围内的主数据（关于客户、供应商、产品和帐户的信息）的解决方案。该方案支持通过协作、操作和分析这三种主数据使用风格集中多个数据领域。 IBM InfoSphere MDM中存在信息泄露漏洞。攻击者可利用该漏洞获取敏感信息。

Severity

中

Patch Name

IBM InfoSphere Master Data Management信息泄露漏洞（CNVD-2015-04439）的补丁

Patch Description

IBM InfoSphere Master Data Management（MDM）是美国IBM公司的一套用于帮助组织管理整个企业范围内的主数据（关于客户、供应商、产品和帐户的信息）的解决方案。该方案支持通过协作、操作和分析这三种主数据使用风格集中多个数据领域。IBM InfoSphere MDM中存在信息泄露漏洞。攻击者可利用该漏洞获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，补丁获取链接： http://www-01.ibm.com/support/docview.wss?uid=swg21960244

Reference

http://www.securityfocus.com/bid/75474 http://www-01.ibm.com/support/docview.wss?uid=swg21960244

Impacted products

Name
IBM InfoSphere Master Data Management

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "75474"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2015-1984"
    }
  },
  "description": "IBM InfoSphere Master Data Management\uff08MDM\uff09\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u7528\u4e8e\u5e2e\u52a9\u7ec4\u7ec7\u7ba1\u7406\u6574\u4e2a\u4f01\u4e1a\u8303\u56f4\u5185\u7684\u4e3b\u6570\u636e\uff08\u5173\u4e8e\u5ba2\u6237\u3001\u4f9b\u5e94\u5546\u3001\u4ea7\u54c1\u548c\u5e10\u6237\u7684\u4fe1\u606f\uff09\u7684\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u652f\u6301\u901a\u8fc7\u534f\u4f5c\u3001\u64cd\u4f5c\u548c\u5206\u6790\u8fd9\u4e09\u79cd\u4e3b\u6570\u636e\u4f7f\u7528\u98ce\u683c\u96c6\u4e2d\u591a\u4e2a\u6570\u636e\u9886\u57df\u3002\r\n\r\nIBM InfoSphere MDM\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "IBM",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttp://www-01.ibm.com/support/docview.wss?uid=swg21960244",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-04439",
  "openTime": "2015-07-14",
  "patchDescription": "IBM InfoSphere Master Data Management\uff08MDM\uff09\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u7528\u4e8e\u5e2e\u52a9\u7ec4\u7ec7\u7ba1\u7406\u6574\u4e2a\u4f01\u4e1a\u8303\u56f4\u5185\u7684\u4e3b\u6570\u636e\uff08\u5173\u4e8e\u5ba2\u6237\u3001\u4f9b\u5e94\u5546\u3001\u4ea7\u54c1\u548c\u5e10\u6237\u7684\u4fe1\u606f\uff09\u7684\u89e3\u51b3\u65b9\u6848\u3002\u8be5\u65b9\u6848\u652f\u6301\u901a\u8fc7\u534f\u4f5c\u3001\u64cd\u4f5c\u548c\u5206\u6790\u8fd9\u4e09\u79cd\u4e3b\u6570\u636e\u4f7f\u7528\u98ce\u683c\u96c6\u4e2d\u591a\u4e2a\u6570\u636e\u9886\u57df\u3002IBM InfoSphere MDM\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM InfoSphere Master Data Management\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2015-04439\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "IBM InfoSphere Master Data Management"
  },
  "referenceLink": "http://www.securityfocus.com/bid/75474\r\nhttp://www-01.ibm.com/support/docview.wss?uid=swg21960244",
  "serverity": "\u4e2d",
  "submitTime": "2015-07-10",
  "title": "IBM InfoSphere Master Data Management\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2015-04439\uff09"
}

CVE-2015-1984 (GCVE-0-2015-1984)

Vulnerability from cvelistv5 – Published: 2015-07-20 01:00 – Updated: 2024-08-06 05:02

Summary

IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to bypass intended access restrictions and read arbitrary profiles via unspecified vectors, as demonstrated by discovering usernames for use in brute-force attacks.

Severity ?

No CVSS data available.

CWE

Assigner

ibm

References

URL

Tags

	http://www.securityfocus.com/bid/75474	vdb-entryx_refsource_BID
	http://www-01.ibm.com/support/docview.wss?uid=swg…	x_refsource_CONFIRM

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T05:02:42.810Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "75474",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/75474"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21960244"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2015-06-26T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to bypass intended access restrictions and read arbitrary profiles via unspecified vectors, as demonstrated by discovering usernames for use in brute-force attacks."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-11-28T20:57:01",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "name": "75474",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/75474"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21960244"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2015-1984",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM InfoSphere Master Data Management Collaborative Edition 9.1, 10.1, 11.0, 11.3, and 11.4 before FP03 allows remote authenticated users to bypass intended access restrictions and read arbitrary profiles via unspecified vectors, as demonstrated by discovering usernames for use in brute-force attacks."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "75474",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/75474"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21960244",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21960244"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2015-1984",
    "datePublished": "2015-07-20T01:00:00",
    "dateReserved": "2015-02-19T00:00:00",
    "dateUpdated": "2024-08-06T05:02:42.810Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2015-04439

CVE-2015-1984 (GCVE-0-2015-1984)

Tags

Sightings

Nomenclature