CVE-2008-5686

IBM Tivoli Provisioning Manager <5.1.1.1 IF0006 - RCE

Title source: llm

Description

IBM Tivoli Provisioning Manager (TPM) before 5.1.1.1 IF0006, when its LDAP service is shared with other applications, does not require that an LDAP user be listed in the TPM user records, which allows remote authenticated users to execute SOAP commands that access arbitrary TPM functionality, as demonstrated by running provisioning workflows.

References (5)

[Vendor Advisory] http://secunia.com/advisories/33143

[Patch, Vendor Advisory] http://www-01.ibm.com/support/docview.wss?uid=swg21330228

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/32824

[Third Party Advisory, VDB Entry] http://securitytracker.com/id?1021394

[Third Party Advisory] http://www.vupen.com/english/advisories/2008/3432

Scores

EPSS 0.0074

EPSS Percentile 72.7%

Classification

CWE

CWE-287

Status draft

Affected Products (4)

ibm/tivoli_provisioning_manager

Timeline

Published Dec 19, 2008

Tracked Since Feb 18, 2026