CVE-2013-6719

delivery.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the testconn_host parameter.

CVSS v2.0 6.0 MEDIUM

6.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.exploit-db.com/exploits/32546
https://exchange.xforce.ibmcloud.com/vulnerabilities/89228
https://tealeaf.support.ibmcloud.com/FileManagement/Download/19eb90ffb8334b398684b4350edc4b7a	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:tealeaf_cx:7.1:::::::*
	cpe:2.3:a:ibm:tealeaf_cx:7.2:::::::*
	cpe:2.3:a:ibm:tealeaf_cx:8.0:::::::*
	cpe:2.3:a:ibm:tealeaf_cx:8.1:::::::*
	cpe:2.3:a:ibm:tealeaf_cx:8.2:::::::*
	cpe:2.3:a:ibm:tealeaf_cx:8.3:::::::*
	cpe:2.3:a:ibm:tealeaf_cx:8.4:::::::*
	cpe:2.3:a:ibm:tealeaf_cx:8.5:::::::*
	cpe:2.3:a:ibm:tealeaf_cx:8.6:::::::*
	cpe:2.3:a:ibm:tealeaf_cx:8.7:::::::*
	cpe:2.3:a:ibm:tealeaf_cx:8.8:::::::*

History

No history.

Information

Published : 2014-03-06 11:55

Updated : 2024-02-04 18:35

NVD link : CVE-2013-6719

Mitre link : CVE-2013-6719

CVE.ORG link : CVE-2013-6719

JSON object : View

Products Affected

ibm

tealeaf_cx

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2013-6719", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-03-06T11:55:05.083", "references": [{"url": "http://www.exploit-db.com/exploits/32546", "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89228", "source": "psirt@us.ibm.com"}, {"url": "https://tealeaf.support.ibmcloud.com/FileManagement/Download/19eb90ffb8334b398684b4350edc4b7a", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "delivery.php in the Passive Capture Application (PCA) web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the testconn_host parameter."}, {"lang": "es", "value": "Se presenta una vulnerabilidad en el archivo delivery.php en la consola web Passive Capture Application (PCA) en Tealeaf CX de IBM versiones 7.x, versiones 8.x hasta 8.6, versi\u00f3n 8.7 anterior a FP2 y versi\u00f3n 8.8 anterior a FP2, que permite a los usuarios autenticados remotos ejecutar comandos arbitrarios por medio de metacaracteres de shell en el par\u00e1metro testconn_host."}], "lastModified": "2017-08-29T01:33:59.560", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:tealeaf_cx:7.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "73F221E7-D026-497A-9E31-80316209F47C"}, {"criteria": "cpe:2.3:a:ibm:tealeaf_cx:7.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE1B92C7-F61A-428F-986A-826AA55E3DF5"}, {"criteria": "cpe:2.3:a:ibm:tealeaf_cx:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE9DFC4D-402A-4E34-BBC1-EF52F06CF141"}, {"criteria": "cpe:2.3:a:ibm:tealeaf_cx:8.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4C449AA9-EEC0-4A6C-80E0-994CD266299E"}, {"criteria": "cpe:2.3:a:ibm:tealeaf_cx:8.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F39FE62-829E-4743-AEDC-04F8B96F42D0"}, {"criteria": "cpe:2.3:a:ibm:tealeaf_cx:8.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "67EED387-1AF6-4900-90DC-664D0DC01D8C"}, {"criteria": "cpe:2.3:a:ibm:tealeaf_cx:8.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBE26E75-B709-4435-A12D-86476DDBF7DF"}, {"criteria": "cpe:2.3:a:ibm:tealeaf_cx:8.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4F32997D-CF8A-4DA9-91D3-C4B793C203C2"}, {"criteria": "cpe:2.3:a:ibm:tealeaf_cx:8.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5B9CB5C-0E75-45EB-B85D-7CF3EAE3C930"}, {"criteria": "cpe:2.3:a:ibm:tealeaf_cx:8.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE939856-ADAA-442D-94E1-3BA1A6865496"}, {"criteria": "cpe:2.3:a:ibm:tealeaf_cx:8.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E742288-47B2-4903-8881-E8E2700A4422"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}