CVE-2013-2994

IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 incorrectly maintains a valid session after unspecified interaction with REST services, which allows remote attackers to issue REST requests in the context of an arbitrary user's active session via unknown vectors.

CVSS v2.0 6.4 MEDIUM

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg1JR45420
http://www-01.ibm.com/support/docview.wss?uid=swg21644393	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/84033
http://www-01.ibm.com/support/docview.wss?uid=swg1JR45420
http://www-01.ibm.com/support/docview.wss?uid=swg21644393	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/84033

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:websphere_commerce:7.0:feature_pack4::::::
	cpe:2.3:a:ibm:websphere_commerce:7.0:feature_pack5::::::

History

21 Nov 2024, 01:52

Type	Values Removed	Values Added
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg1JR45420 -~~	() http://www-01.ibm.com/support/docview.wss?uid=swg1JR45420 -
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg21644393 - Vendor Advisory~~	() http://www-01.ibm.com/support/docview.wss?uid=swg21644393 - Vendor Advisory
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/84033 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/84033 -

Information

Published : 2013-08-01 13:32

Updated : 2024-11-21 01:52

NVD link : CVE-2013-2994

Mitre link : CVE-2013-2994

CVE.ORG link : CVE-2013-2994

JSON object : View

Products Affected

ibm

websphere_commerce

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2013-2994", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-08-01T13:32:25.660", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR45420", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21644393", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/84033", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1JR45420", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21644393", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/84033", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "IBM WebSphere Commerce 7.0 Feature Pack 4 and Feature Pack 5 incorrectly maintains a valid session after unspecified interaction with REST services, which allows remote attackers to issue REST requests in the context of an arbitrary user's active session via unknown vectors."}, {"lang": "es", "value": "IBM WebSphere Commerce 7.0 Feature Pack 4 y Feature Pack 5, mantiene incorrectamente una sesi\u00f3n v\u00e1lida tras una interacci\u00f3n sin especificar con los servicios REST, lo que permite a atacantes remotos emitir peticiones REST en el contexto de una sesi\u00f3n de un usuario arbitrario, a trav\u00e9s de vectores no especificados."}], "lastModified": "2024-11-21T01:52:48.310", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:websphere_commerce:7.0:feature_pack4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "807D497B-7BC0-4F43-A3E9-E9A5E3189BB1"}, {"criteria": "cpe:2.3:a:ibm:websphere_commerce:7.0:feature_pack5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39A4546E-5CA7-47F3-A85F-D0C46E821218"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}