CVE-2013-5375

Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6, 6.0.1 before SR7, 6.0.0 before SR15, and 5.0.0 before SR16 FP4 allows remote attackers to access restricted classes via unspecified vectors related to XML and XSL.

CVSS v2.0 6.8 MEDIUM

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg1IV51089
http://www-01.ibm.com/support/docview.wss?uid=swg1IV51090
http://www-01.ibm.com/support/docview.wss?uid=swg21655201	Vendor Advisory
https://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2013	Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21655202	Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1507.html
http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html
http://rhn.redhat.com/errata/RHSA-2013-1508.html
http://rhn.redhat.com/errata/RHSA-2013-1509.html
http://rhn.redhat.com/errata/RHSA-2013-1793.html
http://secunia.com/advisories/56338
https://exchange.xforce.ibmcloud.com/vulnerabilities/86901

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:java:7.0.0.0:::::::*
	cpe:2.3:a:ibm:java:5.0.0.0:::::::*
	cpe:2.3:a:ibm:java:6.0.0.0:::::::*
	cpe:2.3:a:ibm:java:6.0.1.0:::::::*

Information

Published : 2013-11-24 18:55

Updated : 2017-08-29 01:33

NVD link : CVE-2013-5375

Mitre link : CVE-2013-5375

JSON object : View

Products Affected

ibm

java

CWE

NVD-CWE-noinfo

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV51089", "name": "IV51089", "tags": [], "refsource": "AIXAPAR"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IV51090", "name": "IV51090", "tags": [], "refsource": "AIXAPAR"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21655201", "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21655201", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2013", "name": "https://www.ibm.com/developerworks/java/jdk/alerts/#IBM_Security_Update_November_2013", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21655202", "name": "http://www-01.ibm.com/support/docview.wss?uid=swg21655202", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1507.html", "name": "RHSA-2013:1507", "tags": [], "refsource": "REDHAT"}, {"url": "http://lists.opensuse.org/opensuse-security-announce/2013-11/msg00013.html", "name": "SUSE-SU-2013:1677", "tags": [], "refsource": "SUSE"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1508.html", "name": "RHSA-2013:1508", "tags": [], "refsource": "REDHAT"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1509.html", "name": "RHSA-2013:1509", "tags": [], "refsource": "REDHAT"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-1793.html", "name": "RHSA-2013:1793", "tags": [], "refsource": "REDHAT"}, {"url": "http://secunia.com/advisories/56338", "name": "56338", "tags": [], "refsource": "SECUNIA"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/86901", "name": "ibm-xslt-cve20135375-security-bypass(86901)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Unspecified vulnerability in IBM Java SDK 7.0.0 before SR6, 6.0.1 before SR7, 6.0.0 before SR15, and 5.0.0 before SR16 FP4 allows remote attackers to access restricted classes via unspecified vectors related to XML and XSL."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2013-5375", "ASSIGNER": "psirt@us.ibm.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "impactScore": 6.4, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2013-11-24T18:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ibm:java:7.0.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:java:5.0.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:java:6.0.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:java:6.0.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-29T01:33Z"}