CVE-2011-5078

The web administration interface in the server in Sybase M-Business Anywhere 6.7 before ESD# 3 and 7.0 before ESD# 7 does not require admin authentication for unspecified scripts, which allows remote authenticated users to list or delete user accounts, modify passwords, or read log files via HTTP requests, aka Bug IDs 678497 and 678499.

CVSS v2.0 6.5 MEDIUM

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.sybase.com/detail?id=1095200	Vendor Advisory
http://www.verisigninc.com/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=952

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:sybase:m-business_anywhere:6.7:::::::*
	cpe:2.3:a:sybase:m-business_anywhere:7.0:::::::*

History

No history.

Information

Published : 2012-02-08 21:55

Updated : 2024-02-28 11:41

NVD link : CVE-2011-5078

Mitre link : CVE-2011-5078

CVE.ORG link : CVE-2011-5078

JSON object : View

Products Affected

sybase

m-business_anywhere

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2011-5078", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-02-08T21:55:01.483", "references": [{"url": "http://www.sybase.com/detail?id=1095200", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.verisigninc.com/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=952", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The web administration interface in the server in Sybase M-Business Anywhere 6.7 before ESD# 3 and 7.0 before ESD# 7 does not require admin authentication for unspecified scripts, which allows remote authenticated users to list or delete user accounts, modify passwords, or read log files via HTTP requests, aka Bug IDs 678497 and 678499."}, {"lang": "es", "value": "La interfaz de administraci\u00f3n Web en el servidor Sybase M-Business Anywhere v6.7 antes de ESD#3 y v7.0 antes de ESD#7 no requiere autenticaci\u00f3n de administrador, lo que permite listar o eliminar cuentas de usuario, modificar las contrase\u00f1as o leer los archivos de registro a usuarios remotos autenticados a trav\u00e9s de peticiones HTTP. Se trata de un problema explicados con los Bugs ID 678497 y 678499."}], "lastModified": "2012-02-09T05:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sybase:m-business_anywhere:6.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F1936F3F-29C2-4A0C-888C-63283DE36F95"}, {"criteria": "cpe:2.3:a:sybase:m-business_anywhere:7.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "64F6DCB4-4C2B-4773-A6C8-976EFC1AEFAD"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}