CVE-2013-2961

The internal web server in the Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3, 6.2.1 through FP4, 6.2.2 through FP9, and 6.2.3 before FP3, as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations Application Manager) 1.2.1 before 1.2.1.0-TIV-IAMSB-FP0004 and other products, allows remote attackers to perform unspecified redirection of HTTP requests, and bypass the proxy-server configuration, via crafted HTTP traffic.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg1IV27192
http://www-01.ibm.com/support/docview.wss?uid=swg1IV30187
http://www-01.ibm.com/support/docview.wss?uid=swg1IV40115
http://www-01.ibm.com/support/docview.wss?uid=swg1IV40116
http://www-01.ibm.com/support/docview.wss?uid=swg21635080
http://www-01.ibm.com/support/docview.wss?uid=swg21640752	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/83725
http://www-01.ibm.com/support/docview.wss?uid=swg1IV27192
http://www-01.ibm.com/support/docview.wss?uid=swg1IV30187
http://www-01.ibm.com/support/docview.wss?uid=swg1IV40115
http://www-01.ibm.com/support/docview.wss?uid=swg1IV40116
http://www-01.ibm.com/support/docview.wss?uid=swg21635080
http://www-01.ibm.com/support/docview.wss?uid=swg21640752	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/83725

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:tivoli_monitoring:6.2.0:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.0.1:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.0.2:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.0.3:::::::*

Configuration 2 (hide)

OR	cpe:2.3:a:ibm:tivoli_monitoring:6.2.1:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.1.1:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.1.2:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.1.3:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.1.4:::::::*

Configuration 3 (hide)

OR	cpe:2.3:a:ibm:tivoli_monitoring:6.2.2:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.1:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.2:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.3:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.4:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.5:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.6:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.7:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.8:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.9:::::::*

Configuration 4 (hide)

OR	cpe:2.3:a:ibm:tivoli_monitoring:6.2.3:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.3.1:::::::*
	cpe:2.3:a:ibm:tivoli_monitoring:6.2.3.2:::::::*

Configuration 5 (hide)

cpe:2.3:a:ibm:application_manager_for_smart_business:1.2.1:*:*:*:*:*:*:*

History

21 Nov 2024, 01:52

Type	Values Removed	Values Added
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg1IV27192 -~~	() http://www-01.ibm.com/support/docview.wss?uid=swg1IV27192 -
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg1IV30187 -~~	() http://www-01.ibm.com/support/docview.wss?uid=swg1IV30187 -
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg1IV40115 -~~	() http://www-01.ibm.com/support/docview.wss?uid=swg1IV40115 -
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg1IV40116 -~~	() http://www-01.ibm.com/support/docview.wss?uid=swg1IV40116 -
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg21635080 -~~	() http://www-01.ibm.com/support/docview.wss?uid=swg21635080 -
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg21640752 - Vendor Advisory~~	() http://www-01.ibm.com/support/docview.wss?uid=swg21640752 - Vendor Advisory
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/83725 -~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/83725 -

Information

Published : 2013-06-21 17:55

Updated : 2025-04-11 00:51

NVD link : CVE-2013-2961

Mitre link : CVE-2013-2961

CVE.ORG link : CVE-2013-2961

JSON object : View

Products Affected

ibm

tivoli_monitoring
application_manager_for_smart_business

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2013-2961", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2013-06-21T17:55:01.227", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV27192", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV30187", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV40115", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV40116", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21635080", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21640752", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83725", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV27192", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV30187", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV40115", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV40116", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21635080", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21640752", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/83725", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The internal web server in the Basic Services component in IBM Tivoli Monitoring (ITM) 6.2.0 through FP3, 6.2.1 through FP4, 6.2.2 through FP9, and 6.2.3 before FP3, as used in IBM Application Manager for Smart Business (formerly Tivoli Foundations Application Manager) 1.2.1 before 1.2.1.0-TIV-IAMSB-FP0004 and other products, allows remote attackers to perform unspecified redirection of HTTP requests, and bypass the proxy-server configuration, via crafted HTTP traffic."}, {"lang": "es", "value": "El servidor web interno en el componente Basic Services en IBM Tivoli Monitoring (ITM) v6.2.0 hasta FP3, v6.2.1 hasta FP4, v6.2.2 hasta FP9, y v6.2.3 anterior a FP3, como se utilizaba en IBM Application Manager para Smart Business (Tivoli Foundations Application Manager) v1.2.1 anterior a v1.2.1.0-TIV-IAMSB-FP0004 y otros productos, permite a atacantes remotos llevar a cabo redirecciones HTTP no especificadas, y eludir la configuraci\u00f3n proxy-server, mediante tr\u00e1fico HTTP especialmente dise\u00f1ado."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2289E7D5-2915-42D3-BE86-FF63BF507251"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "45864079-DC1E-42F6-B9D4-36E1A46DE093"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "39A65FE7-7745-4D94-A22C-D0C7CF1C339A"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5DB4F6B1-F1A1-40A3-9EB6-36CBDCF5FD55"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13DB3D7D-0D80-4B7E-B516-D4AE2AE3FC48"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.1.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AD8B5726-CDA8-4BDE-B2A6-AE308959A862"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.1.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6233ED9B-760D-4218-A25B-DF67D703D9EB"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "350B304F-4ED0-4A91-A901-77A149DE2481"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.1.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "50A2D35D-4170-4DD7-9AD3-39F23D432289"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15E20435-C3A0-4A57-B82A-595A48BB0991"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5010AB5-0932-4F05-9D6A-9D4C49151E83"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7299B1C8-7BC2-4F42-B19E-4D0D2E599D02"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1FC98EF0-EDCA-47D8-A4CE-083E3AA0376C"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6522CFEE-4368-4596-8DB9-18247AB19C67"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E386E16-9F8F-4444-A190-EF964CA339F6"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AC24B012-A887-4A3F-A32C-80435C64BC10"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F0B310DC-21E5-4A0D-A3D6-B0FD21C6C4F8"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "499FAEEF-0533-44FE-8249-AE40C6233E06"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.2.9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1E8B4310-F5D2-4448-89C1-E6D656351E7C"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "88380637-715A-49CB-A9B6-0F8411225E9C"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.3.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94A90709-74AD-4C1B-806C-E7E335A3A773"}, {"criteria": "cpe:2.3:a:ibm:tivoli_monitoring:6.2.3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E17308E6-B755-434F-8D2B-E5BBA37BA1F8"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:application_manager_for_smart_business:1.2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A543A0CA-85DE-4277-9E2D-E1323CBC490D"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}

4.3 /10