CVE-2013-6309

IBM Marketing Platform 9.1 before FP2 allows remote authenticated users to hijack sessions, and consequently read records, modify records, or conduct transactions, via an unspecified link injection.

CVSS v2.0 6.0 MEDIUM

6.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg21676688	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/88559
http://www-01.ibm.com/support/docview.wss?uid=swg21676688	Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/88559

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:marketing_platform:9.1.0.0:::::::*
	cpe:2.3:a:ibm:marketing_platform:9.1.0.1:::::::*

History

No history.

Information

Published : 2014-06-28 00:55

Updated : 2025-04-12 10:46

NVD link : CVE-2013-6309

Mitre link : CVE-2013-6309

CVE.ORG link : CVE-2013-6309

JSON object : View

Products Affected

ibm

marketing_platform

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2013-6309", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2014-06-28T00:55:03.157", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676688", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/88559", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21676688", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/88559", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "IBM Marketing Platform 9.1 before FP2 allows remote authenticated users to hijack sessions, and consequently read records, modify records, or conduct transactions, via an unspecified link injection."}, {"lang": "es", "value": "IBM Marketing Platform 9.1 anterior a FP2 permite a usuarios remotos autenticados secuestrar sesiones, y como consecuencia leer archivos, modificar archivos o realizar transacciones, a trav\u00e9s de una inyecci\u00f3n de enlaces no especificada."}], "lastModified": "2025-04-12T10:46:40.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:marketing_platform:9.1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56A0E390-060B-4037-BD87-B0F96DE21CFF"}, {"criteria": "cpe:2.3:a:ibm:marketing_platform:9.1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "951B45A9-07B1-4A2A-8A56-DF6A36DA689E"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}