cve-2014-3070
Vulnerability from cvelistv5
Published
2014-08-22 01:00
Modified
2024-08-06 10:35
Severity ?
Summary
The addFileRegistryAccount Virtual Member Manager (VMM) SPI Admin Task in IBM WebSphere Application Server (WAS) 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3 does not properly create accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors.
References
psirt@us.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg1PI16765
psirt@us.ibm.comhttp://www-01.ibm.com/support/docview.wss?uid=swg21681249Vendor Advisory
psirt@us.ibm.comhttp://www.securityfocus.com/bid/69296
psirt@us.ibm.comhttps://exchange.xforce.ibmcloud.com/vulnerabilities/93777
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg1PI16765
af854a3a-2127-422b-91ae-364da2661108http://www-01.ibm.com/support/docview.wss?uid=swg21681249Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/69296
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/93777
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T10:35:55.927Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ibm-websphere-cve20143070-sec-bypass(93777)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/93777"
          },
          {
            "name": "69296",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/69296"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681249"
          },
          {
            "name": "PI16765",
            "tags": [
              "vendor-advisory",
              "x_refsource_AIXAPAR",
              "x_transferred"
            ],
            "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16765"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2014-08-18T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "The addFileRegistryAccount Virtual Member Manager (VMM) SPI Admin Task in IBM WebSphere Application Server (WAS) 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3 does not properly create accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-08-28T12:57:01",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "name": "ibm-websphere-cve20143070-sec-bypass(93777)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/93777"
        },
        {
          "name": "69296",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/69296"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681249"
        },
        {
          "name": "PI16765",
          "tags": [
            "vendor-advisory",
            "x_refsource_AIXAPAR"
          ],
          "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16765"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2014-3070",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The addFileRegistryAccount Virtual Member Manager (VMM) SPI Admin Task in IBM WebSphere Application Server (WAS) 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3 does not properly create accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ibm-websphere-cve20143070-sec-bypass(93777)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/93777"
            },
            {
              "name": "69296",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/69296"
            },
            {
              "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21681249",
              "refsource": "CONFIRM",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21681249"
            },
            {
              "name": "PI16765",
              "refsource": "AIXAPAR",
              "url": "http://www-01.ibm.com/support/docview.wss?uid=swg1PI16765"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2014-3070",
    "datePublished": "2014-08-22T01:00:00",
    "dateReserved": "2014-04-29T00:00:00",
    "dateUpdated": "2024-08-06T10:35:55.927Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1FD8F9CE-4E98-4187-B84A-429FA1C65E2D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.5.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FC1D7570-4AB4-44B0-B5ED-D103F0946F63\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.5.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9E709E36-B5D0-42E5-A305-AF385FD7F347\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.5.5.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"49506702-1B31-4421-8DEE-5B789272EC6E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.5.5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"158777FD-83D1-44B9-83B4-A3F490CA76F4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.5.5.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EDA2FE6B-6E42-4E97-B803-DAB671D30FF5\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.0.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AF1667C5-D19B-469C-82D5-8406B6D75EDE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.0.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"89551609-69B7-452A-9CB2-04C12D268B41\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.0.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AF27B7D7-4442-47CA-880D-D3B5412AEF9D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.0.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B595B048-4204-49B4-9497-B8D119C8784D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.0.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DC38B5D4-66A3-4671-9099-0F38D283BA94\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.0.0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B357DB53-061F-43D5-9E9F-5D5468A5805B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.0.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"29ADADD2-EC21-4C45-A381-BC2091CD9F7B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.0.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2AD901DE-9258-40DA-A09B-B0CA9DCCF843\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.0.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8C21DDD3-C1CF-4CB2-BA13-4807F17AC5E1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ibm:websphere_application_server:8.0.0.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A6DBD14D-F0F2-4606-BC55-ECB6CCA3EF81\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"The addFileRegistryAccount Virtual Member Manager (VMM) SPI Admin Task in IBM WebSphere Application Server (WAS) 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3 does not properly create accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors.\"}, {\"lang\": \"es\", \"value\": \"addFileRegistryAccount Virtual Member Manager (VMM) SPI Admin Task en IBM WebSphere Application Server (WAS) 8.0.x anterior a 8.0.0.10 y 8.5.x anterior a 8.5.5.3 no crea cuentas debidamente, lo que permite a atacantes remotos evadir las restricciones de acceso a trav\\u00e9s de vectores no especificados.\"}]",
      "id": "CVE-2014-3070",
      "lastModified": "2024-11-21T02:07:24.640",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:N/I:P/A:N\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2014-08-22T01:55:08.057",
      "references": "[{\"url\": \"http://www-01.ibm.com/support/docview.wss?uid=swg1PI16765\", \"source\": \"psirt@us.ibm.com\"}, {\"url\": \"http://www-01.ibm.com/support/docview.wss?uid=swg21681249\", \"source\": \"psirt@us.ibm.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/69296\", \"source\": \"psirt@us.ibm.com\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/93777\", \"source\": \"psirt@us.ibm.com\"}, {\"url\": \"http://www-01.ibm.com/support/docview.wss?uid=swg1PI16765\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www-01.ibm.com/support/docview.wss?uid=swg21681249\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/69296\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/93777\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "psirt@us.ibm.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-264\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2014-3070\",\"sourceIdentifier\":\"psirt@us.ibm.com\",\"published\":\"2014-08-22T01:55:08.057\",\"lastModified\":\"2024-11-21T02:07:24.640\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The addFileRegistryAccount Virtual Member Manager (VMM) SPI Admin Task in IBM WebSphere Application Server (WAS) 8.0.x before 8.0.0.10 and 8.5.x before 8.5.5.3 does not properly create accounts, which allows remote attackers to bypass intended access restrictions via unspecified vectors.\"},{\"lang\":\"es\",\"value\":\"addFileRegistryAccount Virtual Member Manager (VMM) SPI Admin Task en IBM WebSphere Application Server (WAS) 8.0.x anterior a 8.0.0.10 y 8.5.x anterior a 8.5.5.3 no crea cuentas debidamente, lo que permite a atacantes remotos evadir las restricciones de acceso a trav\u00e9s de vectores no especificados.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:N/I:P/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FD8F9CE-4E98-4187-B84A-429FA1C65E2D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC1D7570-4AB4-44B0-B5ED-D103F0946F63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E709E36-B5D0-42E5-A305-AF385FD7F347\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"49506702-1B31-4421-8DEE-5B789272EC6E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"158777FD-83D1-44B9-83B4-A3F490CA76F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.5.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EDA2FE6B-6E42-4E97-B803-DAB671D30FF5\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.0.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF1667C5-D19B-469C-82D5-8406B6D75EDE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.0.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"89551609-69B7-452A-9CB2-04C12D268B41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.0.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF27B7D7-4442-47CA-880D-D3B5412AEF9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.0.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B595B048-4204-49B4-9497-B8D119C8784D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.0.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC38B5D4-66A3-4671-9099-0F38D283BA94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.0.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B357DB53-061F-43D5-9E9F-5D5468A5805B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.0.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"29ADADD2-EC21-4C45-A381-BC2091CD9F7B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.0.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2AD901DE-9258-40DA-A09B-B0CA9DCCF843\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.0.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C21DDD3-C1CF-4CB2-BA13-4807F17AC5E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ibm:websphere_application_server:8.0.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A6DBD14D-F0F2-4606-BC55-ECB6CCA3EF81\"}]}]}],\"references\":[{\"url\":\"http://www-01.ibm.com/support/docview.wss?uid=swg1PI16765\",\"source\":\"psirt@us.ibm.com\"},{\"url\":\"http://www-01.ibm.com/support/docview.wss?uid=swg21681249\",\"source\":\"psirt@us.ibm.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/69296\",\"source\":\"psirt@us.ibm.com\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/93777\",\"source\":\"psirt@us.ibm.com\"},{\"url\":\"http://www-01.ibm.com/support/docview.wss?uid=swg1PI16765\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www-01.ibm.com/support/docview.wss?uid=swg21681249\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/69296\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/93777\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.