What is the CVSS score of CVE-2014-3020?

CVE-2014-3020 has a CVSS 2.0 base score of 6.9 (Medium). CVSS vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. EPSS exploitation probability: 0.0%.

Embedded Websphere Application Server CVE-2014-3020

MEDIUM

Permissions, Privileges, and Access Controls (CWE-264)

2014-07-29 psirt@us.ibm.com

IBM Privilege Escalation Embedded Websphere Application Server Tivoli Integrated Portal

6.9

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

AV:L/AC:M/Au:N/C:C/I:C/A:C

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:M/Au:N/C:C/I:C/A:C

Attack Vector

Local

Attack Complexity

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Jul 29, 2014 - 20:55 cve.org

MEDIUM 6.9

DescriptionCVE.org

install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program.

AnalysisAI

install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree,. Rated medium severity (CVSS 6.9). No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-264. install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program. Affected products include: Ibm Embedded Websphere Application Server, Ibm Tivoli Integrated Portal.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.