Multiple SQL injection vulnerabilities in IBM Tivoli Provisioning Manager Express for…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- SQL injection
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-89.
Summary
Multiple SQL injection vulnerabilities in IBM Tivoli Provisioning Manager Express for Software Distribution 4.1.1 allow remote attackers to execute arbitrary SQL commands via (1) a SOAP message to the Printer.getPrinterAgentKey function in the SoapServlet servlet, (2) the User.updateUserValue function in the register.do servlet, (3) the User.isExistingUser function in the logon.do servlet, (4) the Asset.getHWKey function in the CallHomeExec servlet, (5) the Asset.getMimeType function in the getAttachment (aka GetAttachmentServlet) servlet, (6) the addAsset.do servlet, or (7) a crafted EG2 file.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2012-0199
- 2026-10-03 Alias added: GHSA-8m76-w547-pfph
References
More IBM Tivoli Provisioning Manager Express For Software Distribution vulnerabilities
- TI-2012-00191 Stack-based buffer overflow in the RunAndUploadFile method in the Isig.isigCtl.1 ActiveX… CVSS 2.0HIGH 9.3
Sources
- CVE-2012-0199 · CVE Program
- CVE-2012-0199 · NVD
- FIRST EPSS
- GHSA-8m76-w547-pfph · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences