High severity · published May 22, 2017
CVE-2016-6112
IBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an authenticated user to escalate their privileges and gain administrative permissions over…
8.8
CVSS
1%
EPSS
No
On KEV
Description
IBM Distributed Marketing and Marketing Platform 8.6, 9.0, 9.1, and 10.0 could allow an authenticated user to escalate their privileges and gain administrative permissions over the web application. IBM X-Force ID: 118282.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DM
Distributed Marketing · Ibm
8.6.0.0; 9.0.0.0; 9.1.0.0; 10.0.0.0 · source: NVD
MO
Marketing Operations · Ibm
8.6.0.0; 9.0.0.0; 9.1.0.0; 10.0.0.0 · source: NVD
MP
Marketing Platform · Ibm
8.6.0.0; 9.0.0.0; 9.1.0.0; 9.1.2.0; 10.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-6112
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-6112
Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg21992739
More from Distributed Marketing
2.7
CVE-2016-5979
IBM Distributed Marketing 8.6, 9.0, and 10.0 could allow a privileged authenticated user to create an instance that gets created with security profile not valid for the templates,…