CVE-2010-3474 — IBM DB2 vulnerability

3 documents3 sources
Severity
5.0MEDIUMNVD
CNA7.5
EPSS
0.5%
top 32.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM DB2
Timeline
PublishedSep 20
Latest updateMay 17

Description

IBM DB2 9.7 before FP3 does not perform the expected drops or invalidations of dependent functions upon a loss of privileges by the functions' owners, which allows remote authenticated users to bypass intended access restrictions via calls to these functions, a different vulnerability than CVE-2009-3471.

CVSS vector

AV:N/AC:L/C:N/I:P/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages1 packages

▶NVDibm/db29.7, 9.7.0.1, 9.7.0.2+2

🔴Vulnerability Details

2
GHSA
GHSA-84rv-5h5j-48fx: IBM DB2 9↗2022-05-17
▶
CVEList
CVE-2010-3474: IBM DB2 9↗2010-09-20
▶
CVE-2010-3474 — IBM DB2 vulnerability | cvebase