CVEvulnerability

CVE-2015-1937

7.5 HIGH Published 2015-05-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2015-05-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-284

Description

IBM PowerVC 1.2.0.x through 1.2.0.4, 1.2.1.x through 1.2.1.2, and 1.2.2.x through 1.2.2.2 does not require authentication for the ceilometer NoSQL database, which allows remote attackers to read or write to arbitrary database records, and consequently obtain administrator privileges, via a session on port 27017.

Affected configurations

• ibm powervc 1.2.0.0 • ibm powervc 1.2.0.1 • ibm powervc 1.2.0.2 • ibm powervc 1.2.0.3 • ibm powervc 1.2.0.4 • ibm powervc 1.2.1.0 • ibm powervc 1.2.1.1 • ibm powervc 1.2.1.2 • ibm powervc 1.2.2.0 • ibm powervc 1.2.2.1 • ibm powervc 1.2.2.2

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References