CVE-2016-6104 : IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to u

IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, which could allow the attacker to execute arbitrary code on the vulnerable system.

Published 2017-02-07 16:59:00

Updated 2017-02-13 21:48:46

Source IBM Corporation

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2016-6104

IBM » Security Key Lifecycle Manager » Version: 2.5.0.7
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.7:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0.6
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.6:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0.5
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.5:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.6.0.1
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.6.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0.0
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.0:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0.3
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.3:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0.1
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.1:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0.4
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.4:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0.2
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0.2:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.6.0.2
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.6.0.2:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.6.0
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.6.0:*:*:*:*:*:*:*
Matching versions
IBM » Security Key Lifecycle Manager » Version: 2.5.0
cpe:2.3:a:ibm:security_key_lifecycle_manager:2.5.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-6104

EPSS FAQ

3.46%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 86 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-6104

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:P	8.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.2	HIGH	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	1.2	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2016-6104

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-6104

http://www.securityfocus.com/bid/95980

IBM Tivoli Key Lifecycle Manager CVE-2016-6104 Arbitrary File Upload Vulnerability
Third Party Advisory;VDB Entry
http://www.ibm.com/support/docview.wss?uid=swg21997988

IBM Security Bulletin: IBM Security Key Lifecycle Manager is affected by upload of files of dangerous types (CVE-2016-6104)
Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2016-6104

Products affected by CVE-2016-6104

Exploit prediction scoring system (EPSS) score for CVE-2016-6104

CVSS scores for CVE-2016-6104

CWE ids for CVE-2016-6104

References for CVE-2016-6104