Description
IBM DB2 9.5 before FP7 and 9.7 before FP4 on Linux, UNIX, and Windows does not properly revoke role membership from groups, which allows remote authenticated users to execute non-DDL statements by leveraging previous inherited possession of a role, a different vulnerability than CVE-2011-0757. NOTE: some of these details are obtained from third party information.
References (9)
Core 9
Core References
Various Sources x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IC71375
Various Sources vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IC71263
Various Sources vendor-advisory
x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IC71375
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/66980
Vendor Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2011/1083
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/47525
Various Sources x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IC71263
Third Party Advisory, VDB Entry vdb-entry
signature
x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14688
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/44229
Scores
EPSS
0.0229
EPSS Percentile
81.4%
Details
CWE
CWE-264
Status
published
Products (4)
ibm/db2
9.5 (11 CPE variants)
ibm/db2
9.7 (3 CPE variants)
ibm/db2
< 9.5
ibm/db2
< 9.7
Published
May 03, 2011
Tracked Since
Feb 18, 2026