CVE-2014-3020 — IBM Embedded Websphere Application Server vulnerability

CWE-2643 documents3 sources
Severity
6.9MEDIUMNVD
EPSS
0.0%
top 87.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
IBM Embedded Websphere Application ServerIBM Tivoli Integrated Portal
Timeline
PublishedJul 29
Latest updateMay 17

Description

install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program.

CVSS vector

AV:L/AC:M/C:C/I:C/A:CExploitability: 3.4 | Impact: 10.0

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-76xr-mp9g-83mj: install↗2022-05-17
▶
CVEList
CVE-2014-3020: install↗2014-07-29
▶
CVE-2014-3020 — IBM vulnerability | cvebase