CVE-2008-5686
CVSS V2 High 8.5
CVSS V3 None
Description
IBM Tivoli Provisioning Manager (TPM) before 5.1.1.1 IF0006, when its LDAP service is shared with other applications, does not require that an LDAP user be listed in the TPM user records, which allows remote authenticated users to execute SOAP commands that access arbitrary TPM functionality, as demonstrated by running provisioning workflows.
Overview
- CVE ID
- CVE-2008-5686
- Assigner
- cve@mitre.org
- Vulnerability Status
- Modified
- Published Version
- 2008-12-19T17:30:03
- Last Modified Date
- 2011-03-08T03:14:57
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:ibm:tivoli_provisioning_manager:5.1:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:ibm:tivoli_provisioning_manager:5.1.0.2:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:ibm:tivoli_provisioning_manager:5.1.1:*:*:*:*:*:*:* | 1 | OR | ||
| cpe:2.3:a:ibm:tivoli_provisioning_manager:5.1.1.1:*:*:*:*:*:*:* | 1 | OR |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:M/Au:S/C:C/I:C/A:C
- Access Vector
- NETWORK
- Access Compatibility
- MEDIUM
- Authentication
- SINGLE
- Confidentiality Impact
- COMPLETE
- Integrity Impact
- COMPLETE
- Availability Impact
- COMPLETE
- Base Score
- 8.5
- Severity
- HIGH
- Exploitability Score
- 6.8
- Impact Score
- 10
References
| Reference URL | Reference Tags |
|---|---|
| http://www-01.ibm.com/support/docview.wss?uid=swg21330228 | Patch Vendor Advisory |
| http://secunia.com/advisories/33143 | Vendor Advisory |
| http://securitytracker.com/id?1021394 | |
| http://www.securityfocus.com/bid/32824 | |
| http://www.vupen.com/english/advisories/2008/3432 |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2008-5686 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5686 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 11:01:24 | Added to TrackCVE |