CVE-2008-5686
IBM Tivoli Provisioning Manager (TPM) before 5.1.1.1 IF0006, when its LDAP service is shared with other applications, does not require that an LDAP user be listed in the TPM user records, which allows remote authenticated users to execute SOAP commands…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.14%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
IBM Tivoli Provisioning Manager (TPM) before 5.1.1.1 IF0006, when its LDAP service is shared with other applications, does not require that an LDAP user be listed in the TPM user records, which allows remote authenticated users to execute SOAP commands that access arbitrary TPM functionality, as demonstrated by running provisioning workflows.
- CVSS 2.0
- 8.5 HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C
- EPSS
- 2.14% probability · 81th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- ibm/tivoli provisioning manager
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/33143Vendor Advisory
- http://securitytracker.com/id?1021394
- http://www-01.ibm.com/support/docview.wss?uid=swg21330228Patch, Vendor Advisory
- http://www.securityfocus.com/bid/32824
- http://www.vupen.com/english/advisories/2008/3432
- http://secunia.com/advisories/33143Vendor Advisory
- http://securitytracker.com/id?1021394
- http://www-01.ibm.com/support/docview.wss?uid=swg21330228Patch, Vendor Advisory
- http://www.securityfocus.com/bid/32824
- http://www.vupen.com/english/advisories/2008/3432
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.