CVE-2011-1372

The Web User Interface on the IBM TS3100 and TS3200 tape libraries with firmware before A.60 allows remote attackers to bypass authentication and obtain administrative access via unspecified vectors.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www.ibm.com/support/docview.wss?uid=ssg1S1003938	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/71026

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:ts3100_tape_library_firmware::::::::
	cpe:2.3:a:ibm:ts3200_tape_library_firmware::::::::

OR	cpe:2.3:h:ibm:ts3100_tape_library::::::::
	cpe:2.3:h:ibm:ts3200_tape_library::::::::

History

No history.

Information

Published : 2011-11-28 11:55

Updated : 2017-08-17 01:34

NVD link : CVE-2011-1372

Mitre link : CVE-2011-1372

CVE.ORG link : CVE-2011-1372

JSON object : View

Products Affected

ibm

ts3200_tape_library
ts3100_tape_library_firmware
ts3200_tape_library_firmware
ts3100_tape_library

CWE

CWE-287

Improper Authentication

{"id": "CVE-2011-1372", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-11-28T11:55:08.750", "references": [{"url": "http://www.ibm.com/support/docview.wss?uid=ssg1S1003938", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/71026", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The Web User Interface on the IBM TS3100 and TS3200 tape libraries with firmware before A.60 allows remote attackers to bypass authentication and obtain administrative access via unspecified vectors."}, {"lang": "es", "value": "La interfaz web de usuario en las librer\u00edas de cintas IBM TS3100 y TS3200 con el firmware antes de la versi\u00f3n A.60 permite a atacantes remotos eludir la autenticaci\u00f3n y obtener acceso administrativo a trav\u00e9s de vectores no especificados."}], "lastModified": "2017-08-17T01:34:06.387", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:ts3100_tape_library_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "55FAB85E-3F1C-4C43-ADF4-F58FEA2BACDF", "versionEndIncluding": "a.40"}, {"criteria": "cpe:2.3:a:ibm:ts3200_tape_library_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9E62711F-63BF-428D-BDA3-1A586D7E486F", "versionEndIncluding": "a.40"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ibm:ts3100_tape_library:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "870665B1-1E06-496C-B0D9-3E2A106D4A3F"}, {"criteria": "cpe:2.3:h:ibm:ts3200_tape_library:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5B07F453-CA23-4498-AAF4-10AB324D1F36"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}