Medium severity · published Jan 2, 2016
CVE-2015-5020
The Big SQL component in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0 allows remote authenticated users to bypass intended access restrictions and truncate arbitrary…
4.3
CVSS
1.2%
EPSS
No
On KEV
Description
The Big SQL component in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0 allows remote authenticated users to bypass intended access restrictions and truncate arbitrary tables via unspecified vectors.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IB
Infosphere Biginsights · Ibm
3.0.0.0; 3.0.0.1; 3.0.0.2; 4.0.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-5020
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-5020
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21967923
www.securitytracker.com
http://www.securitytracker.com/id/1034561
More from Infosphere Biginsights
6.5
CVE-2013-3993
IBM InfoSphere BigInsights Invalid Input Vulnerability
7.4
CVE-2015-1947
Untrusted search path vulnerability in IBM InfoSphere BigInsights 3.0, 3.0.0.1, 3.0.0.2, and 4.0, when a DB2 database is used, allows local users to gain privileges via a Trojan…
7.3
CVE-2015-1836
Apache HBase 0.98 before 0.98.12.1, 1.0 before 1.0.1.1, and 1.1 before 1.1.0.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products, uses incorrect…
7.3
CVE-2015-1772
The LDAP implementation in HiveServer2 in Apache Hive before 1.0.1 and 1.1.x before 1.1.1, as used in IBM InfoSphere BigInsights 3.0, 3.0.0.1, and 3.0.0.2 and other products,…
6.5
CVE-2014-4782
IBM InfoSphere BigInsights 2.1.2 allows remote authenticated users to discover SMTP server credentials via vectors related to the Alert management service