CVE-2016-6112 - OpenCVE

IBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an authenticated user to escalate their privileges and gain administrative permissions over the web application. IBM X-Force ID: 118282.

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Ibm	Marketing Operations Marketing Platform Distributed Marketing

Configuration 1 [-]

OR	cpe:2.3:a:ibm:marketing_platform:8.6.0.0:::::::*
	cpe:2.3:a:ibm:marketing_platform:9.0.0.0:::::::*
	cpe:2.3:a:ibm:marketing_platform:9.1.0.0:::::::*
	cpe:2.3:a:ibm:marketing_platform:9.1.2.0:::::::*
	cpe:2.3:a:ibm:marketing_platform:10.0:::::::*

Configuration 2 [-]

OR	cpe:2.3:a:ibm:marketing_operations:8.6.0.0:::::::*
	cpe:2.3:a:ibm:marketing_operations:9.0.0.0:::::::*
	cpe:2.3:a:ibm:marketing_operations:9.1.0.0:::::::*
	cpe:2.3:a:ibm:marketing_operations:10.0.0.0:::::::*

Configuration 3 [-]

OR	cpe:2.3:a:ibm:distributed_marketing:8.6.0.0:::::::*
	cpe:2.3:a:ibm:distributed_marketing:9.0.0.0:::::::*
	cpe:2.3:a:ibm:distributed_marketing:9.1.0.0:::::::*
	cpe:2.3:a:ibm:distributed_marketing:10.0.0.0:::::::*

References

Link	Resource
http://www.ibm.com/support/docview.wss?uid=swg21992739	Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: ibm

Published: 2017-05-22T20:00:00

Updated: 2017-05-22T19:57:01

Reserved: 2016-06-29T00:00:00

Link: CVE-2016-6112

JSON object: View

NVD Information

Status : Analyzed

Published: 2017-05-22T20:29:00.173

Modified: 2017-05-31T00:14:30.567

Link: CVE-2016-6112

JSON object: View

Redhat Information

No data.

CWE

CWE-264

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:marketing_platform:8.6.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "B8A5AFAE-62C2-4606-8173-862BE8575821", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:marketing_platform:9.0.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "AFFD0672-3CA3-41C4-B20C-884DF334A176", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:marketing_platform:9.1.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "56A0E390-060B-4037-BD87-B0F96DE21CFF", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:marketing_platform:9.1.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "805E751A-E060-48BC-B98A-5EBDA75DBCFD", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:marketing_platform:10.0:*:*:*:*:*:*:*", "matchCriteriaId": "A394A760-E812-4D3C-9B00-F55EEA03CFB5", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:marketing_operations:8.6.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "ACFA73E2-B8C4-494F-B894-D25A024B4559", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:marketing_operations:9.0.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "E41E05D9-5E80-42F3-B7A3-C1933EB5D873", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:marketing_operations:9.1.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "AB557416-74AD-4E44-8440-1DEBD90AEC2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:marketing_operations:10.0.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "C4655821-4F02-4B21-B451-F627ECADAED1", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ibm:distributed_marketing:8.6.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "67832F29-CC33-43DE-BE61-5534B2DCD03E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:distributed_marketing:9.0.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "286F79AB-AE7E-4A30-9290-7F197268203E", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:distributed_marketing:9.1.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "3E69AC4F-A5CB-4270-9AE7-706D4D59F61F", "vulnerable": true}, {"criteria": "cpe:2.3:a:ibm:distributed_marketing:10.0.0.0:*:*:*:*:*:*:*", "matchCriteriaId": "2E63FD79-9964-45C8-BE39-22D37ACECECD", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "IBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an authenticated user to escalate their privileges and gain administrative permissions over the web application. IBM X-Force ID: 118282."}, {"lang": "es", "value": "IBM Distributed Marketing y Marketing Platform 8.6, 9.0, 9.1 y 10.0 podr\u00eda permitir a un usuario autenticado escalar sus privilegios y obtener permisos administrativos sobre la aplicaci\u00f3n web. IBM X-Force ID: 118282."}], "id": "CVE-2016-6112", "lastModified": "2017-05-31T00:14:30.567", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-05-22T20:29:00.173", "references": [{"source": "psirt@us.ibm.com", "tags": ["Vendor Advisory"], "url": "http://www.ibm.com/support/docview.wss?uid=swg21992739"}], "sourceIdentifier": "psirt@us.ibm.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}