CVE-2013-0578

CWE-287 — Improper Authentication5 documents5 sources
Severity
3.5LOW
EPSS
0.2%
top 62.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Sterling Multi-channel Fulfillment SolutionIBM Sterling Selling AND Fulfillment Foundation
Timeline
PublishedMay 10
Latest updateMay 17

Description

The Sterling Order Management APIs in IBM Sterling Multi-Channel Fulfillment Solution 8.0 before HF128 and IBM Sterling Selling and Fulfillment Foundation 8.5 before HF93, 9.0 before HF73, 9.1.0 before FP45, and 9.2.0 before FP17, when the API tester is enabled, do not require administrative credentials, which allows remote authenticated users to obtain sensitive database information via a request to the API tester URI.

CVSS vector

AV:N/AC:M/C:P/I:N/A:NExploitability: 6.8 | Impact: 2.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-7pjw-c9w7-9xgf: The Sterling Order Management APIs in IBM Sterling Multi-Channel Fulfillment Solution 8↗2022-05-17
▶
CVEList
CVE-2013-0578: The Sterling Order Management APIs in IBM Sterling Multi-Channel Fulfillment Solution 8↗2013-05-10
▶

📋Vendor Advisories

1
Red Hat
mysql: unspecified DoS vulnerability related to Server Optimizer (CPU Jan 2013)↗2013-01-15
▶

💬Community

1
Bugzilla
CVE-2012-0578 mysql: unspecified DoS vulnerability related to Server Optimizer (CPU Jan 2013)↗2013-01-16
▶
CVE-2013-0578 (LOW CVSS 3.5) | The Sterling Order Management APIs | cvebase.io