Multiple vulnerabilities in IBM Algo Credit Manager



Published: 2017-12-15 | Updated: 2017-12-18
Risk Low
Patch available YES
Number of vulnerabilities 7
CVE-ID CVE-2017-10356
CVE-2017-10357
CVE-2017-10348
CVE-2017-10349
CVE-2017-10347
CVE-2017-10350
CVE-2017-10281
CWE-ID CWE-264
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		IBM Algo Credit Manager
Client/Desktop applications / Other client software

Vendor IBM Corporation

Security Bulletin

This security bulletin contains information about 7 vulnerabilities.

1) Improper access control

EUVDB-ID: #VU9120

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-10356

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The weakness exists due to a flaw in the Security component. A remote attacker can gain unauthorized access to sensitive information.

Mitigation

Update to version 5.4.1.0, 5.3.0.5, 5.2.0.5.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4

External links

http://www-01.ibm.com/support/docview.wss?uid=swg22011316&myns=swgimgmt&mynp=OCSSNM52&mync=E&cm_sp=swgimgmt-_-OCSSNM52-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU8878

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-10357

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the Serialization component. A remote attacker can trigger partial denial of service.

Mitigation

Update to version 5.4.1.0, 5.3.0.5, 5.2.0.5.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4

External links

http://www-01.ibm.com/support/docview.wss?uid=swg22011316&myns=swgimgmt&mynp=OCSSNM52&mync=E&cm_sp=swgimgmt-_-OCSSNM52-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper access control

EUVDB-ID: #VU8873

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-10348

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the Libraries component. A remote attacker can trigger partial denial of service.

Mitigation

Update to version 5.4.1.0, 5.3.0.5, 5.2.0.5.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4

External links

http://www-01.ibm.com/support/docview.wss?uid=swg22011316&myns=swgimgmt&mynp=OCSSNM52&mync=E&cm_sp=swgimgmt-_-OCSSNM52-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper access control

EUVDB-ID: #VU8874

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-10349

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the JAXP component. A remote attacker can trigger partial denial of service.

Mitigation

Update to version 5.4.1.0, 5.3.0.5, 5.2.0.5.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4

External links

http://www-01.ibm.com/support/docview.wss?uid=swg22011316&myns=swgimgmt&mynp=OCSSNM52&mync=E&cm_sp=swgimgmt-_-OCSSNM52-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Denial of service

EUVDB-ID: #VU8864

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-10347

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the Serialization component. A remote attacker can trigger partial denial of service on the target system.

Mitigation

Update to version 5.4.1.0, 5.3.0.5, 5.2.0.5.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4

External links

http://www-01.ibm.com/support/docview.wss?uid=swg22011316&myns=swgimgmt&mynp=OCSSNM52&mync=E&cm_sp=swgimgmt-_-OCSSNM52-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper access control

EUVDB-ID: #VU8875

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-10350

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the JAX-WS component. A remote attacker can trigger partial denial of service.

Mitigation

Update to version 5.4.1.0, 5.3.0.5, 5.2.0.5.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4

External links

http://www-01.ibm.com/support/docview.wss?uid=swg22011316&myns=swgimgmt&mynp=OCSSNM52&mync=E&cm_sp=swgimgmt-_-OCSSNM52-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Denial of service

EUVDB-ID: #VU8863

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-10281

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to cause DoS condition.

The weakness exists due to a flaw in the Serialization component. A remote attacker can trigger partial denial of service on the target system.

Mitigation

Update to version 5.4.1.0, 5.3.0.5, 5.2.0.5.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4

External links

http://www-01.ibm.com/support/docview.wss?uid=swg22011316&myns=swgimgmt&mynp=OCSSNM52&mync=E&cm_sp=swgimgmt-_-OCSSNM52-_-E


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###