High severity · published Feb 1, 2017
CVE-2016-6068
IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResource secured role properties
7.5
CVSS
1.4%
EPSS
No
On KEV
Description
IBM UrbanCode Deploy could allow an authenticated user with access to the REST endpoints to access API and CLI getResource secured role properties.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UD
UrbanCode Deploy · IBM Corporation
6.1.0.2; 6.0; 6.0.1; 6.0.1.1; 6.0.1.2; 6.0.1.3; +34 more · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6068
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6068
Patch
http://www.ibm.com/support/docview.wss?uid=swg2C1000229
Technical Description
http://www.securityfocus.com/bid/95290
More from UrbanCode Deploy
10.0
CVE-2016-8938
IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server
7.5
CVE-2016-2942
IBM UrbanCode Deploy could allow an authenticated attacker with special permissions to craft a script on the server in a way that will cause processes to run on a remote UCD agent…
7.5
CVE-2016-9008
IBM UrbanCode Deploy could allow a malicious user to access the Agent Relay ActiveMQ Broker JMX interface and run plugins on the agent
5.5
CVE-2016-2941
IBM UrbanCode Deploy creates temporary files during step execution that could contain sensitive information including passwords that could be read by a local user
5.4
CVE-2016-9006
IBM UrbanCode Deploy 6.1 and 6.2 is vulnerable to cross-site scripting