CVE-2013-2989

The file-copying functionality in IBM Sterling Connect:Direct 3.8.00, 4.0.00, and 4.1.0 for UNIX on AIX 6.1 through 7.1 uses incorrect privileges, which allows local users to bypass filesystem read permissions and write permissions by leveraging authentication to the Connect:Direct product.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.8 UNKNOWN
LOCAL
LOW
AV:L/AC:L/Au:S/C:C/I:C/A:C
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
ibmsterling_connect
3.8.00
ibmsterling_connect
4.0.00
ibmsterling_connect
4.1.0.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www-01.ibm.com/support/docview.wss?uid=swg1IC86449
http://www-01.ibm.com/support/docview.wss?uid=swg21637561
https://exchange.xforce.ibmcloud.com/vulnerabilities/84016
http://www-01.ibm.com/support/docview.wss?uid=swg1IC86449
http://www-01.ibm.com/support/docview.wss?uid=swg21637561
https://exchange.xforce.ibmcloud.com/vulnerabilities/84016