VAR-201511-0266

Vulnerability from variot - Updated: 2025-04-13 23:35

Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access, and consequently provide ZipDownload.jsp input containing directory traversal sequences to read arbitrary files, via a request to port 40080 or 40443. Authentication is not required to exploit this vulnerability.The specific flaws exist within the IBM SNSC Web Service, which listens by default on ports 40080 (HTTP) or 40443 (HTTPS) for requests to the administration panel. The first is a race condition, which allows the for the temporary use of a fixed privileged account which is forbidden from interactive login, and the second is the ability to specify any file on the system in ZipDownload.jsp. By combining these two vulnerabilities, an attacker can read arbitrary files on the system. This may aid in further attacks

Show details on source website
To clipboard 

{
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "ibm",
        "version": "7.3.1.4"
      },
      {
        "_id": null,
        "model": "switch center",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "lenovo",
        "version": "8.1.1.0"
      },
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "ibm",
        "version": "7.3.1.5"
      },
      {
        "_id": null,
        "model": "switch center",
        "scope": "lt",
        "trust": 0.8,
        "vendor": "lenovo",
        "version": "8.1.2.0"
      },
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": null,
        "trust": 0.7,
        "vendor": "ibm",
        "version": null
      },
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "ibm",
        "version": "7.3.1.4"
      },
      {
        "_id": null,
        "model": "switch center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "lenovo",
        "version": "8.1.1.0"
      },
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.3.11"
      },
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.111"
      },
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.2.110"
      },
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.32"
      },
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.31"
      },
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.3.1.2"
      },
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.3.4"
      },
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.3.0"
      },
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.2.0"
      },
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1.1.0"
      },
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.1"
      },
      {
        "_id": null,
        "model": "switch center",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "lenovo",
        "version": "8.1.2.0"
      },
      {
        "_id": null,
        "model": "system networking switch center",
        "scope": "ne",
        "trust": 0.3,
        "vendor": "ibm",
        "version": "7.3.1.5"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-15-554"
      },
      {
        "db": "BID",
        "id": "77554"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-005921"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-171"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-7820"
      }
    ]
  },
  "configurations": {
    "_id": null,
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/a:ibm:system_networking_switch_center",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/a:lenovo:switch_center",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-005921"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "Andrea Micalizzi (rgod)",
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-15-554"
      },
      {
        "db": "BID",
        "id": "77554"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-171"
      }
    ],
    "trust": 1.6
  },
  "cve": "CVE-2015-7820",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.6,
            "id": "CVE-2015-7820",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 2.5,
            "vectorString": "AV:N/AC:M/Au:N/C:C/I:N/A:N",
            "version": "2.0"
          },
          {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "NONE",
            "baseScore": 7.1,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.6,
            "id": "VHN-85781",
            "impactScore": 6.9,
            "integrityImpact": "NONE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:M/AU:N/C:C/I:N/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2015-7820",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2015-7820",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "ZDI",
            "id": "CVE-2015-7820",
            "trust": 0.7,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201511-171",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-85781",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-15-554"
      },
      {
        "db": "VULHUB",
        "id": "VHN-85781"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-005921"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-171"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-7820"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "Race condition in the administration-panel web service in IBM System Networking Switch Center (SNSC) before 7.3.1.5 and Lenovo Switch Center before 8.1.2.0 allows remote attackers to obtain privileged-account access, and consequently provide ZipDownload.jsp input containing directory traversal sequences to read arbitrary files, via a request to port 40080 or 40443. Authentication is not required to exploit this vulnerability.The specific flaws exist within the IBM SNSC Web Service, which listens by default on ports 40080 (HTTP) or 40443 (HTTPS) for requests to the administration panel. The first is a race condition, which allows the for the temporary use of a fixed privileged account which is forbidden from interactive login, and the second is the ability to specify any file on the system in ZipDownload.jsp. By combining these two vulnerabilities, an attacker can read arbitrary files on the system. This may aid in further attacks",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2015-7820"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-005921"
      },
      {
        "db": "ZDI",
        "id": "ZDI-15-554"
      },
      {
        "db": "BID",
        "id": "77554"
      },
      {
        "db": "VULHUB",
        "id": "VHN-85781"
      }
    ],
    "trust": 2.61
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2015-7820",
        "trust": 3.5
      },
      {
        "db": "ZDI",
        "id": "ZDI-15-554",
        "trust": 3.5
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-005921",
        "trust": 0.8
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-3011",
        "trust": 0.7
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-171",
        "trust": 0.7
      },
      {
        "db": "BID",
        "id": "77554",
        "trust": 0.4
      },
      {
        "db": "SEEBUG",
        "id": "SSVID-89838",
        "trust": 0.1
      },
      {
        "db": "VULHUB",
        "id": "VHN-85781",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-15-554"
      },
      {
        "db": "VULHUB",
        "id": "VHN-85781"
      },
      {
        "db": "BID",
        "id": "77554"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-005921"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-171"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-7820"
      }
    ]
  },
  "id": "VAR-201511-0266",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-85781"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2025-04-13T23:35:06.014000Z",
  "patch": {
    "_id": null,
    "data": [
      {
        "title": "LEN-2015-074",
        "trust": 0.8,
        "url": "https://support.lenovo.com/jp/ja/product_security/len_2015_074"
      },
      {
        "title": "IBM has issued an update to correct this vulnerability.",
        "trust": 0.7,
        "url": "https://support.lenovo.com/us/en/product_security/len_2015_074"
      },
      {
        "title": "Lenovo Switch Center Repair measures for competitive conditions",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=58665"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-15-554"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-005921"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-171"
      }
    ]
  },
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "CWE-362",
        "trust": 1.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-85781"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-005921"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-7820"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 2.8,
        "url": "http://www.zerodayinitiative.com/advisories/zdi-15-554/"
      },
      {
        "trust": 2.7,
        "url": "https://support.lenovo.com/us/en/product_security/len_2015_074"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7820"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-7820"
      },
      {
        "trust": 0.3,
        "url": "http://www.ibm.com/"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-15-554"
      },
      {
        "db": "VULHUB",
        "id": "VHN-85781"
      },
      {
        "db": "BID",
        "id": "77554"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-005921"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-171"
      },
      {
        "db": "NVD",
        "id": "CVE-2015-7820"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "ZDI",
        "id": "ZDI-15-554",
        "ident": null
      },
      {
        "db": "VULHUB",
        "id": "VHN-85781",
        "ident": null
      },
      {
        "db": "BID",
        "id": "77554",
        "ident": null
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-005921",
        "ident": null
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-171",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2015-7820",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2015-11-10T00:00:00",
        "db": "ZDI",
        "id": "ZDI-15-554",
        "ident": null
      },
      {
        "date": "2015-11-12T00:00:00",
        "db": "VULHUB",
        "id": "VHN-85781",
        "ident": null
      },
      {
        "date": "2015-11-10T00:00:00",
        "db": "BID",
        "id": "77554",
        "ident": null
      },
      {
        "date": "2015-11-16T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-005921",
        "ident": null
      },
      {
        "date": "2015-11-11T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201511-171",
        "ident": null
      },
      {
        "date": "2015-11-12T03:59:08.500000",
        "db": "NVD",
        "id": "CVE-2015-7820",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2015-11-10T00:00:00",
        "db": "ZDI",
        "id": "ZDI-15-554",
        "ident": null
      },
      {
        "date": "2015-11-12T00:00:00",
        "db": "VULHUB",
        "id": "VHN-85781",
        "ident": null
      },
      {
        "date": "2015-11-10T00:00:00",
        "db": "BID",
        "id": "77554",
        "ident": null
      },
      {
        "date": "2015-11-16T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2015-005921",
        "ident": null
      },
      {
        "date": "2015-11-13T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201511-171",
        "ident": null
      },
      {
        "date": "2025-04-12T10:46:40.837000",
        "db": "NVD",
        "id": "CVE-2015-7820",
        "ident": null
      }
    ]
  },
  "threat_type": {
    "_id": null,
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-171"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "_id": null,
    "data": "IBM System Networking Switch Center and  Lenovo Switch Center Vulnerable to gaining access to privileged accounts",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2015-005921"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "_id": null,
    "data": "competitive condition",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201511-171"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.