CVE-2015-4951

MEDIUM

IBM Spectrum Protect 5.5-6.x < 6.3.2.5, 6.4 < 6.4.3.1, 7.1 < 7.1.3 - Denial of Service via Crafted Web Client URL

Title source: llm
STIX 2.1

Description

Client Acceptor Daemon (CAD) in the client in IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 and 6.x before 6.3.2.5, 6.4 before 6.4.3.1, and 7.1 before 7.1.3 allows remote attackers to cause a denial of service (daemon crash) via a crafted Web client URL.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1034692
Patch, Vendor Advisory x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21973484

Scores

CVSS v3 5.3
EPSS 0.0135
EPSS Percentile 68.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Details

CWE
CWE-20
Status published
Products (6)
ibm/tivoli_storage_manager 5.5
ibm/tivoli_storage_manager 6.1
ibm/tivoli_storage_manager 6.2
ibm/tivoli_storage_manager 6.3
ibm/tivoli_storage_manager 6.4
ibm/tivoli_storage_manager 7.1
Published Jan 20, 2016
Tracked Since Feb 18, 2026