CVE-2011-5078

Status: ModifiedMedium (6.5)—

The web administration interface in the server in Sybase M-Business Anywhere 6.7 before ESD# 3 and 7.0 before ESD# 7 does not require admin authentication for unspecified scripts, which allows remote authenticated users to list or delete user accounts, modify passwords, or read log files via HTTP requests, aka Bug IDs 678497 and 678499.

CVSS

Version: 2.0
Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Base score: 6.5

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 1.03%
Percentile among all scored CVEs: 62
Score date: 10/5/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Sybase — M-business Anywhere

CWEs

CWE-264

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2011-5078",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2012-02-08T21:55:01.483",
  "references": [
    {
      "url": "http://www.sybase.com/detail?id=1095200",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.verisigninc.com/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=952",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.sybase.com/detail?id=1095200",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.verisigninc.com/products-and-services/network-intelligence-availability/idefense/public-vulnerability-reports/articles/index.xhtml?id=952",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The web administration interface in the server in Sybase M-Business Anywhere 6.7 before ESD# 3 and 7.0 before ESD# 7 does not require admin authentication for unspecified scripts, which allows remote authenticated users to list or delete user accounts, modify passwords, or read log files via HTTP requests, aka Bug IDs 678497 and 678499."
    },
    {
      "lang": "es",
      "value": "La interfaz de administración Web en el servidor Sybase M-Business Anywhere v6.7 antes de ESD#3 y v7.0 antes de ESD#7 no requiere autenticación de administrador, lo que permite listar o eliminar cuentas de usuario, modificar las contraseñas o leer los archivos de registro a usuarios remotos autenticados a través de peticiones HTTP. Se trata de un problema explicados con los Bugs ID 678497 y 678499."
    }
  ],
  "lastModified": "2026-06-16T23:35:54.320",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sybase:m-business_anywhere:6.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F1936F3F-29C2-4A0C-888C-63283DE36F95"
            },
            {
              "criteria": "cpe:2.3:a:sybase:m-business_anywhere:7.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "64F6DCB4-4C2B-4773-A6C8-976EFC1AEFAD"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}