Unscored severity · published Jul 29, 2014
CVE-2014-3020
install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the…
–
CVSS
0.3%
EPSS
No
On KEV
Description
install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EW
Embedded Websphere Application Server · Ibm
7.0 · source: NVD
TI
Tivoli Integrated Portal · Ibm
2.1; 2.2 · source: NVD
Affected product
EW
Embedded Websphere Application Server
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3020
secunia.com
http://secunia.com/advisories/59687
secunia.com
http://secunia.com/advisories/59795
secunia.com
http://secunia.com/advisories/60552
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21679952
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg21680254
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg21680841