CVE-2015-4950: The mailbox-restore feature in IBM Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 6.1 before 6.1.3.6, 6.3 before 6.3.1.3, 6.4 before 6.4.1.4, and…

Description

The mailbox-restore feature in IBM Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 6.1 before 6.1.3.6, 6.3 before 6.3.1.3, 6.4 before 6.4.1.4, and 7.1 before 7.1.0.2; Tivoli Storage FlashCopy Manager: FlashCopy Manager for Microsoft Exchange Server 2.1, 2.2, 3.1 before 3.1.1.5, 3.2 before 3.2.1.7, and 4.1 before 4.1.1; and Tivoli Storage Manager FastBack for Microsoft Exchange 6.1 before 6.1.5.4 does not ensure that the correct mailbox is selected, which allows remote authenticated users to obtain sensitive information via a duplicate alias name.

Exploitation

Is it being used?

Exploit prediction (EPSS)1.6% · higher than 76% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

TS

Tivoli Storage Fastback For Microsoft Exchange · Ibm

6.1 · source: NVD

TS

Tivoli Storage Flashcopy Manager For Microsoft Exchange Server · Ibm

2.1; 2.2; 3.1; 3.2; 4.1 · source: NVD

TS

Tivoli Storage Manager For Mail Data Protection For Microsoft Exchange Server · Ibm

6.1; 6.1.1; 6.1.2; 6.1.3; 6.3; 6.3.1; +3 more · source: NVD