CVE-2015-6745

Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security mechanism by deleting the entry from the locking table. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6744.

CVSS v2.0 4.6 MEDIUM

4.6^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 3.9 / Impact : 6.4

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://seclists.org/fulldisclosure/2015/Jul/120
https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuvuus-2015-018.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:basware:banking:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2015-08-31 14:59

Updated : 2024-02-04 18:53

NVD link : CVE-2015-6745

Mitre link : CVE-2015-6745

CVE.ORG link : CVE-2015-6745

JSON object : View

Products Affected

basware

banking

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2015-6745", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2015-08-31T14:59:04.900", "references": [{"url": "http://seclists.org/fulldisclosure/2015/Jul/120", "source": "cve@mitre.org"}, {"url": "https://www.viestintavirasto.fi/en/cybersecurity/vulnerabilities/2015/haavoittuvuus-2015-018.html", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Basware Banking (Maksuliikenne) 8.90.07.X relies on the client to enforce account locking, which allows local users to bypass that security mechanism by deleting the entry from the locking table. NOTE: this identifier was SPLIT from CVE-2015-0942 per ADT2 and ADT3 due to different vulnerability type and different affected versions. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-6744."}, {"lang": "es", "value": "Vulnerabilidad en Basware Banking (Maksuliikenne) 8.90.07.X, conf\u00eda en el cliente para hacer cumplir el bloqueo de cuenta, lo que permite a usuarios locales evadir este mecanismo de seguridad mediante la supresi\u00f3n de la tabla de bloqueo. NOTA: este identificador fue SEPARADO de CVE-2015-0942 por ADT2 y ADT3 debido a los diferentes tipos de vulnerabilidades y diferentes versiones afectadas. NOTA: esta vulnerabilidad existe debido a una soluci\u00f3n incorrecta para CVE-2015-6744."}], "lastModified": "2015-08-31T19:08:00.877", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:basware:banking:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35D5DDC9-E7FE-4699-9FF7-B6EFCB2E07BF", "versionEndIncluding": "8.90.07"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}