CVE-2013-6334 Auth bypass in n/a

What is CVE-2013-6334?

CVE-2013-6334 is a medium-severity authentication bypass vulnerability in n/a, published on 10 Jan 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM Atlas eDiscovery Process Management 6.0.1.5 and earlier and 6.0.2, Disposal and Governance Management for IT 6.0.1.5 and earlier and 6.0.2, and Global Retention Policy and Schedule Management 6.0.1.5 and earlier and 6.0.2 in IBM Atlas Suite (aka Atlas Policy Suite) do not properly validate sessions, which allows remote attackers to bypass intended access restrictions, and visit PolicyAtlas/ResponseDraftServlet (aka the Compliance Questionnaire Save Draft servlet), via unspecified vectors.

Weakness: CWE-20

Which versions are affected by CVE-2013-6334?

It affects 4 products.

Products include Ibm Atlas Ediscovery Process Management, Ibm Atlas Suite, Ibm Disposal and Governance Management for It, Ibm Global Retention Policy and Schedule Management.

How do I fix CVE-2013-6334?

No fix has been published for CVE-2013-6334 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2013-6334 being exploited?

There is no known exploitation of CVE-2013-6334 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2017-1356 SQL injection in Atlas eDiscovery Process Management High 8.8
• CVE-2013-6321 SQL injection in n/a High 7.5
• CVE-2017-1354 Cross-site scripting in Atlas eDiscovery Process Management Medium 5.4
• CVE-2014-0889 Cross-site scripting in n/a Medium 4.3
• CVE-2017-1355 Information disclosure in Atlas eDiscovery Process Management Low 3.7

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-g446-343g-jrpr.