Unscored severity · published Mar 26, 2014
CVE-2013-3976
The (1) Data Protection for Exchange component 6.1 before 6.1.3.4 and 6.3 before 6.3.1 in IBM Tivoli Storage Manager for Mail and the (2) FlashCopy Manager for Exchange component…
–
CVSS
0.9%
EPSS
No
On KEV
Description
The (1) Data Protection for Exchange component 6.1 before 6.1.3.4 and 6.3 before 6.3.1 in IBM Tivoli Storage Manager for Mail and the (2) FlashCopy Manager for Exchange component 2.2 and 3.1 before 3.1.1 in IBM Tivoli Storage FlashCopy Manager do not properly constrain mailbox contents during certain PST restore operations, which allows remote authenticated users to read the personal e-mail of other users in opportunistic circumstances by launching an e-mail client after an administrator performs a multiple-mailbox restore.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DP
Data Protection · Ibm
6.1; 6.3 · source: NVD
FM
Flashcopy Manager · Ibm
2.1; 2.2; 3.1 · source: NVD
TS
Tivoli Storage Flashcopy Manager · Ibm
All versions, or not specified · source: NVD
TS
Tivoli Storage Manager For Mail · Ibm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-3976
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-3976
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IC81223
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21644407
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/84881
More from Data Protection
7.8
CVE-2018-1987
IBM Spectrum Protect for Enterprise Resource Planning 7.1 and 8.1, if tracing is activated, the IBM Spectrum Protect node password may be displayed in plain text in the ERP trace…