Unscored severity · published Nov 14, 2015
CVE-2015-7404
IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server (aka Spectrum Protect for Databases) 5.5 before 5.5.6.2, 6.3 before 6.3.1.6, 6.4 before 6.4.1.8,…
–
CVSS
0.4%
EPSS
No
On KEV
Description
IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server (aka Spectrum Protect for Databases) 5.5 before 5.5.6.2, 6.3 before 6.3.1.6, 6.4 before 6.4.1.8, and 7.1 before 7.1.4; Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server (aka Spectrum Protect for Mail) 5.5 before 5.5.1.1, 6.1 and 6.3 before 6.3.1.6, 6.4 before 6.4.1.8, and 7.1 before 7.1.4; and Tivoli Storage FlashCopy Manager for Windows (aka Spectrum Protect Snapshot) 2.x and 3.1 before 3.1.1.6, 3.2 before 3.2.1.8, and 4.1 before 4.1.4, when application tracing is configured, write cleartext passwords during changetsmpassword command execution, which allows local users to obtain sensitive information by reading the application trace output.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
Tivoli Storage Flashcopy Manager · Ibm
2.1.0; 2.2.0; 2.2.1; 3.1.0; 3.1.1; 3.2.0; +4 more · source: NVD
TS
Tivoli Storage Manager For Databases Data Protection For Microsoft Sql Server · Ibm
5.5; 5.5.1; 5.5.2; 5.5.3; 5.5.4; 5.5.5; +21 more · source: NVD
TS
Tivoli Storage Manager For Mail Data Protection For Microsoft Exchange Server · Ibm
5.5; 5.5.1; 6.1; 6.1.1; 6.1.2; 6.1.3; +11 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7404
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7404
www-01.ibm.com
http://www-01.ibm.com/support/docview.wss?uid=swg1IT11349
Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21969514
More from Tivoli Storage Flashcopy Manager
–
CVE-2015-1988
Cross-site scripting (XSS) vulnerability in IBM Tivoli Storage Manger for Virtual Environments: Data Protection for VMware 6.3 before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before…
–
CVE-2015-6557
IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 5.5 before 5.5.6.1, 6.3 before 6.3.1.5, 6.4 before 6.4.1.7, and 7.1 before 7.1.2; Tivoli Storage…
–
CVE-2015-4949
IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 7.1 before 7.1.2, Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server…
–
CVE-2013-6714
The FlashCopy Manager for VMware component in IBM Tivoli Storage FlashCopy Manager 3.1 through 4.1.0.1 does not properly check authorization for backup and restore operations,…
–
CVE-2013-3976
The (1) Data Protection for Exchange component 6.1 before 6.1.3.4 and 6.3 before 6.3.1 in IBM Tivoli Storage Manager for Mail and the (2) FlashCopy Manager for Exchange component…