CVE-2016-0373 - OpenCVE

IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:S/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Ibm	Urbancode Deploy

Configuration 1 [-]

cpe:2.3:a:ibm:urbancode_deploy:*:*:*:*:*:*:*:*

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg2C1000219	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/112119	VDB Entry Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: ibm

Published: 2016-11-14T00:00:00

Updated: 2018-08-30T15:57:01

Reserved: 2015-12-08T00:00:00

Link: CVE-2016-0373

JSON object: View

NVD Information

Status : Modified

Published: 2018-08-30T16:29:00.557

Modified: 2019-10-09T23:16:11.790

Link: CVE-2016-0373

JSON object: View

Redhat Information

No data.

CWE

CWE-285

{"containers": {"cna": {"affected": [{"product": "UrbanCode Deploy", "vendor": "IBM", "versions": [{"status": "affected", "version": "6.1.0.2"}, {"status": "affected", "version": "6.0"}, {"status": "affected", "version": "6.0.1"}, {"status": "affected", "version": "6.0.1.1"}, {"status": "affected", "version": "6.0.1.2"}, {"status": "affected", "version": "6.0.1.3"}, {"status": "affected", "version": "6.0.1.4"}, {"status": "affected", "version": "6.0.1.5"}, {"status": "affected", "version": "6.0.1.6"}, {"status": "affected", "version": "6.1"}, {"status": "affected", "version": "6.1.0.1"}, {"status": "affected", "version": "6.1.0.3"}, {"status": "affected", "version": "6.0.1.7"}, {"status": "affected", "version": "6.0.1.8"}, {"status": "affected", "version": "6.1.0.4"}, {"status": "affected", "version": "6.1.1"}, {"status": "affected", "version": "6.1.1.1"}, {"status": "affected", "version": "6.1.1.2"}, {"status": "affected", "version": "6.1.1.3"}, {"status": "affected", "version": "6.1.1.4"}, {"status": "affected", "version": "6.1.1.5"}, {"status": "affected", "version": "6.0.1.9"}, {"status": "affected", "version": "6.1.1.6"}, {"status": "affected", "version": "6.1.1.7"}, {"status": "affected", "version": "6.1.2"}, {"status": "affected", "version": "6.0.1.10"}, {"status": "affected", "version": "6.0.1.11"}, {"status": "affected", "version": "6.1.1.8"}, {"status": "affected", "version": "6.1.3"}, {"status": "affected", "version": "6.1.3.1"}, {"status": "affected", "version": "6.2"}, {"status": "affected", "version": "6.2.0.1"}, {"status": "affected", "version": "6.0.1.12"}, {"status": "affected", "version": "6.1.3.2"}, {"status": "affected", "version": "6.2.0.2"}, {"status": "affected", "version": "6.2.1"}, {"status": "affected", "version": "6.0.1.13"}, {"status": "affected", "version": "6.2.1.1"}, {"status": "affected", "version": "6.0.1.14"}, {"status": "affected", "version": "6.1.3.3"}, {"status": "affected", "version": "6.2.2"}, {"status": "affected", "version": "6.2.2.1"}]}], "datePublic": "2016-11-14T00:00:00", "descriptions": [{"lang": "en", "value": "IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119."}], "metrics": [{"cvssV3_0": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "exploitCodeMaturity": "UNPROVEN", "integrityImpact": "NONE", "privilegesRequired": "LOW", "remediationLevel": "OFFICIAL_FIX", "reportConfidence": "CONFIRMED", "scope": "UNCHANGED", "temporalScore": 2.7, "temporalSeverity": "LOW", "userInteraction": "NONE", "vectorString": "CVSS:3.0/A:N/AC:H/AV:N/C:L/I:N/PR:L/S:U/UI:N/E:U/RC:C/RL:O", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"description": "Obtain Information", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-08-30T15:57:01", "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg2C1000219"}, {"name": "ibm-ucd-cve20160373-info-disc(112119)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/112119"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@us.ibm.com", "DATE_PUBLIC": "2016-11-14T00:00:00", "ID": "CVE-2016-0373", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "UrbanCode Deploy", "version": {"version_data": [{"version_value": "6.1.0.2"}, {"version_value": "6.0"}, {"version_value": "6.0.1"}, {"version_value": "6.0.1.1"}, {"version_value": "6.0.1.2"}, {"version_value": "6.0.1.3"}, {"version_value": "6.0.1.4"}, {"version_value": "6.0.1.5"}, {"version_value": "6.0.1.6"}, {"version_value": "6.1"}, {"version_value": "6.1.0.1"}, {"version_value": "6.1.0.3"}, {"version_value": "6.0.1.7"}, {"version_value": "6.0.1.8"}, {"version_value": "6.1.0.4"}, {"version_value": "6.1.1"}, {"version_value": "6.1.1.1"}, {"version_value": "6.1.1.2"}, {"version_value": "6.1.1.3"}, {"version_value": "6.1.1.4"}, {"version_value": "6.1.1.5"}, {"version_value": "6.0.1.9"}, {"version_value": "6.1.1.6"}, {"version_value": "6.1.1.7"}, {"version_value": "6.1.2"}, {"version_value": "6.0.1.10"}, {"version_value": "6.0.1.11"}, {"version_value": "6.1.1.8"}, {"version_value": "6.1.3"}, {"version_value": "6.1.3.1"}, {"version_value": "6.2"}, {"version_value": "6.2.0.1"}, {"version_value": "6.0.1.12"}, {"version_value": "6.1.3.2"}, {"version_value": "6.2.0.2"}, {"version_value": "6.2.1"}, {"version_value": "6.0.1.13"}, {"version_value": "6.2.1.1"}, {"version_value": "6.0.1.14"}, {"version_value": "6.1.3.3"}, {"version_value": "6.2.2"}, {"version_value": "6.2.2.1"}]}}]}, "vendor_name": "IBM"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119."}]}, "impact": {"cvssv3": {"BM": {"A": "N", "AC": "H", "AV": "N", "C": "L", "I": "N", "PR": "L", "S": "U", "UI": "N"}, "TM": {"E": "U", "RC": "C", "RL": "O"}}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Obtain Information"}]}]}, "references": {"reference_data": [{"name": "http://www-01.ibm.com/support/docview.wss?uid=swg2C1000219", "refsource": "CONFIRM", "url": "http://www-01.ibm.com/support/docview.wss?uid=swg2C1000219"}, {"name": "ibm-ucd-cve20160373-info-disc(112119)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/112119"}]}}}}, "cveMetadata": {"assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "assignerShortName": "ibm", "cveId": "CVE-2016-0373", "datePublished": "2016-11-14T00:00:00", "dateReserved": "2015-12-08T00:00:00", "dateUpdated": "2018-08-30T15:57:01", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:urbancode_deploy:*:*:*:*:*:*:*:*", "matchCriteriaId": "82634693-BA46-4AEA-861B-767C21445FF2", "versionEndIncluding": "6.2.2.1", "versionStartIncluding": "6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119."}, {"lang": "es", "value": "IBM UrbanCode Deploy, desde la versi\u00f3n 6.0 hasta la 6.2.2.1 podr\u00eda permitir que un usuario autenticado lea informaci\u00f3n sensible debido a que los endpoints UCD REST no autorizan debidamente a los usuarios al determinar qui\u00e9n puede leer datos. IBM X-Force ID: 112119."}], "id": "CVE-2016-0373", "lastModified": "2019-10-09T23:16:11.790", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "psirt@us.ibm.com", "type": "Secondary"}]}, "published": "2018-08-30T16:29:00.557", "references": [{"source": "psirt@us.ibm.com", "tags": ["Patch", "Vendor Advisory"], "url": "http://www-01.ibm.com/support/docview.wss?uid=swg2C1000219"}, {"source": "psirt@us.ibm.com", "tags": ["VDB Entry", "Vendor Advisory"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/112119"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "nvd@nist.gov", "type": "Primary"}]}