description: IBM UrbanCode Deploy 6.0 through 6.2.2.1 could allow an authenticated user to read sensitive information due to UCD REST endpoints not properly authorizing users when determining who can read data. IBM X-Force ID: 112119.
problem types: Obtain Information
affected:
{
product: UrbanCode Deploy
vendor: IBM
versions:
status: affected, version: 6.1.0.2
status: affected, version: 6.0
status: affected, version: 6.0.1
status: affected, version: 6.0.1.1
status: affected, version: 6.0.1.2
status: affected, version: 6.0.1.3
status: affected, version: 6.0.1.4
status: affected, version: 6.0.1.5
status: affected, version: 6.0.1.6
status: affected, version: 6.1
status: affected, version: 6.1.0.1
status: affected, version: 6.1.0.3
status: affected, version: 6.0.1.7
status: affected, version: 6.0.1.8
status: affected, version: 6.1.0.4
status: affected, version: 6.1.1
status: affected, version: 6.1.1.1
status: affected, version: 6.1.1.2
status: affected, version: 6.1.1.3
status: affected, version: 6.1.1.4
status: affected, version: 6.1.1.5
status: affected, version: 6.0.1.9
status: affected, version: 6.1.1.6
status: affected, version: 6.1.1.7
status: affected, version: 6.1.2
status: affected, version: 6.0.1.10
status: affected, version: 6.0.1.11
status: affected, version: 6.1.1.8
status: affected, version: 6.1.3
status: affected, version: 6.1.3.1
status: affected, version: 6.2
status: affected, version: 6.2.0.1
status: affected, version: 6.0.1.12
status: affected, version: 6.1.3.2
status: affected, version: 6.2.0.2
status: affected, version: 6.2.1
status: affected, version: 6.0.1.13
status: affected, version: 6.2.1.1
status: affected, version: 6.0.1.14
status: affected, version: 6.1.3.3
status: affected, version: 6.2.2
status: affected, version: 6.2.2.1
}
metrics:
cvssV3_0: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
exploitCodeMaturity: UNPROVEN
integrityImpact: NONE
privilegesRequired: LOW
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 2.7
temporalSeverity: LOW
userInteraction: NONE
vectorString: CVSS:3.0/A:N/AC:H/AV:N/C:L/I:N/PR:L/S:U/UI:N/E:U/RC:C/RL:O
version: 3.0
]