CVE-2014-6122

Status: ModifiedMedium (5.5)—

IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows remote authenticated users to write to arbitrary folders, and consequently execute arbitrary commands, via a modified argument.

CVSS

Version: 2.0
Vector: AV:N/AC:L/Au:S/C:N/I:P/A:P
Base score: 5.5

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 1.54%
Percentile among all scored CVEs: 74
Score date: 10/6/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (2)

IBM — Security Appscan IBM — Security Appscan Source

CWEs

CWE-264

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2014-6122",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@us.ibm.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2014-12-23T02:59:02.357",
  "references": [
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21693035",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1031427",
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96723",
      "source": "psirt@us.ibm.com"
    },
    {
      "url": "http://www-01.ibm.com/support/docview.wss?uid=swg21693035",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1031427",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96723",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Security AppScan Enterprise 8.5 before 8.5 IFix 002, 8.6 before 8.6 IFix 004, 8.7 before 8.7 IFix 004, 8.8 before 8.8 iFix 003, 9.0 before 9.0.0.1 iFix 003, and 9.0.1 before 9.0.1 iFix 001 allows remote authenticated users to write to arbitrary folders, and consequently execute arbitrary commands, via a modified argument."
    },
    {
      "lang": "es",
      "value": "IBM Security AppScan Enterprise 8.5 anterior a 8.5 IFix 002, 8.6 anteriora 8.6 IFix 004, 8.7 anterior a 8.7 IFix 004, 8.8 anterior a 8.8 iFix 003, 9.0 anterior a 9.0.0.1 iFix 003, y 9.0.1 anterior a 9.0.1 iFix 001 permite a usuarios remotos autenticados escribir en carpetas arbitrarias, y consecuentemente ejecutar comandos arbitrarios, a través de un argumento modificado."
    }
  ],
  "lastModified": "2026-06-17T00:12:36.427",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:security_appscan:8.5:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "692FDD2B-0DB7-4016-B329-2A7C04E93CE8"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_appscan:8.6:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E6BD30B4-C6C6-4DDB-95B0-E0DBF1056F8C"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_appscan:8.7:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "041F2DE0-4791-4A91-A0B2-B251706DB05B"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_appscan:8.8:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75617EAA-BE1C-477D-BDDE-0C61582FE5AF"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_appscan:9.0:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D09C700-2B51-4EDC-93A1-366C6A9C5A3C"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_appscan:9.0.0.1:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D4CDD602-C438-4432-B722-2B2FB36F05A7"
            },
            {
              "criteria": "cpe:2.3:a:ibm:security_appscan_source:9.0.1:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F67CFF41-85F4-477A-93C9-C1A28766D2EC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@us.ibm.com"
}