What is the CVSS score of CVE-2015-1959?

CVE-2015-1959 has a CVSS 2.0 base score of 4.6 (Medium). CVSS vector: AV:L/AC:L/Au:N/C:P/I:P/A:P. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2015-1959?

Yes, a patch is available for CVE-2015-1959. Update the affected software to the latest version immediately.

Tivoli Directory Server CVE-2015-1959

MEDIUM

Improper Access Control (CWE-284)

2015-06-28 psirt@us.ibm.com

IBM Authentication Bypass Tivoli Directory Server

4.6

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:L/AC:L/Au:N/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:L/AC:L/Au:N/C:P/I:P/A:P

Attack Vector

Local

Attack Complexity

Low

Confidentiality

Integrity

Availability

Lifecycle Timeline

CVE Published

Jun 28, 2015 - 15:59 cve.org

MEDIUM 4.6

DescriptionCVE.org

IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not properly restrict encrypted files, which allows local users to obtain sensitive information or possibly have unspecified other impact via a (1) download or (2) upload action.

AnalysisAI

IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not properly restrict encrypted. Rated medium severity (CVSS 4.6), this vulnerability is low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-284. IBM Tivoli Security Directory Server 6.0 before iFix 75, 6.1 before iFix 68, 6.2 before iFix 44, 6.3 before iFix 37, 6.3.1 before iFix 11, and 6.4 before iFix 2 does not properly restrict encrypted files, which allows local users to obtain sensitive information or possibly have unspecified other impact via a (1) download or (2) upload action. Affected products include: Ibm Tivoli Directory Server.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.