description: IBM PureApplication System 2.2.3.0 through 2.2.5.3 weakness in the implementation of locking feature in pattern editor. An attacker by intercepting the subsequent requests can bypass business logic to modify the pattern to unlocked state. IBM X-Force ID: 159416.
problem types: Gain Access
affected:
{
product: PureApplication System
vendor: IBM
versions:
status: affected, version: 2.2.3.0
status: affected, version: 2.2.3.1
status: affected, version: 2.2.3.2
status: affected, version: 2.2.4.0
status: affected, version: 2.2.5.0
status: affected, version: 2.2.5.1
status: affected, version: 2.2.5.2
status: affected, version: 2.2.5.3
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
exploitCodeMaturity: UNPROVEN
integrityImpact: LOW
privilegesRequired: LOW
remediationLevel: OFFICIAL_FIX
reportConfidence: CONFIRMED
scope: UNCHANGED
temporalScore: 3.8
temporalSeverity: LOW
userInteraction: NONE
vectorString: CVSS:3.0/C:N/AV:N/S:U/PR:L/A:N/AC:L/I:L/UI:N/RC:C/E:U/RL:O
version: 3.0
]