Unscored severity · published Aug 23, 2015
CVE-2015-4949
IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 7.1 before 7.1.2, Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server…
–
CVSS
0.4%
EPSS
No
On KEV
Description
IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 7.1 before 7.1.2, Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 7.1 before 7.1.2, and Tivoli Storage FlashCopy Manager 4.1 before 4.1.2 place cleartext passwords in exception messages, which allows physically proximate attackers to obtain sensitive information by reading GUI pop-up windows, a different vulnerability than CVE-2015-6557.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
Tivoli Storage Flashcopy Manager · Ibm
4.1.0; 4.1.2 · source: NVD
TS
Tivoli Storage Manager For Databases Data Protection For Microsoft Sql Server · Ibm
7.1; 7.2 · source: NVD
TS
Tivoli Storage Manager For Mail Data Protection For Microsoft Exchange Server · Ibm
7.1; 7.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-4949
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-4949
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IT03480
Patch
http://www-01.ibm.com/support/docview.wss?uid=swg21963630
www.securitytracker.com
http://www.securitytracker.com/id/1033270
More from Tivoli Storage Flashcopy Manager
–
CVE-2015-7404
IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server (aka Spectrum Protect for Databases) 5.5 before 5.5.6.2, 6.3 before 6.3.1.6, 6.4 before 6.4.1.8,…
–
CVE-2015-1988
Cross-site scripting (XSS) vulnerability in IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before…
–
CVE-2015-6557
IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 5.5 before 5.5.6.1, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; Tivoli Storage…
–
CVE-2013-6714
The FlashCopy Manager for VMware component in IBM Tivoli Storage FlashCopy Manager 3.1 through 4.1.0.1 does not properly check authorization for backup and restore operations,…
–
CVE-2013-3976
The (1) Data Protection for Exchange component 6.1 before 6.1.3.4 and 6.3 before 6.3.1 in IBM Tivoli Storage Manager for Mail and the (2) FlashCopy Manager for Exchange component…