9.3

CVE-2014-6140

Exploit

EPSS 10.07%
Veröffentlicht 06.12.2014 15:59:04
Zuletzt bearbeitet 12.04.2025 10:46:40
Quelle psirt@us.ibm.com
CVE-Watchlists
Login
Unerledigt
Login

IBM Tivoli Endpoint Manager Mobile Device Management (MDM) before 9.0.60100 uses the same secret HMAC token across different customers' installations, which allows remote attackers to execute arbitrary code via crafted marshalled Ruby objects in cookies to (1) Enrollment and Apple iOS Management Extender, (2) Self-service portal, (3) Trusted Services provider, or (4) Admin Portal.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 0 Referenzen 10

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Ibm ≫ Tivoli Endpoint Manager Mobile Device Management Version <= 9.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	10.07%	0.924

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	9.3	8.6	10	AV:N/AC:M/Au:N/C:C/I:C/A:C

http://packetstormsecurity.com/files/129349/IBM-Endpoint-Manager-For-Mobile-Devices-Code-Execution.html

Exploit

http://seclists.org/fulldisclosure/2014/Dec/3

Exploit

http://www-01.ibm.com/support/docview.wss?uid=swg21691701

Vendor Advisory

http://www.securityfocus.com/archive/1/534131/100/0/threaded

http://www.securityfocus.com/bid/71424

http://www.securitytracker.com/id/1031306

https://www.redteam-pentesting.de/en/advisories/rt-sa-2014-012/-unauthenticated-remote-code-execution-in-ibm-endpoint-manager-mobile-device-management-components

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2014-6140

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-6140

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-6140

EUVD