CVE-2013-0517

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

A Command Execution Vulnerability exists in IBM Sterling External Authentication Server 2.2.0, 2.3.01, 2.4.0, and 2.4.1 via an unspecified OS command, which could let a local malicious user execute arbitrary code.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
IBM	Sterling External Authentication Server	2.2.0; 2.3.01; 2.4.0; and 2.4.1

References

http://www.securityfocus.com/bid/59807Third Party Advisory, VDB Entry
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-addressed-in-ibm-sterling-external-authentication-server-cve-2013-0514-cve-2013-0517-4/Vendor Advisory
http://www.securityfocus.com/bid/59807Third Party Advisory, VDB Entry
https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-addressed-in-ibm-sterling-external-authentication-server-cve-2013-0514-cve-2013-0517-4/Vendor Advisory

Timeline

Published: Feb 11, 2020
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-05184.3IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 does CVE-2013-05195.0IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 prov CVE-2013-05204.0IBM Sterling Secure Proxy 3.2.0 and 3.3.01 before 3.3.01.23 Interim Fix 1, 3.4.0 before 3.4.0.6 Interim Fix 1, and 3.4.1 before 3.4.1.7 allo CVE-2013-05227.0The Notes Client Single Logon feature in IBM Notes 8.0, 8.0.1, 8.0.2, 8.5, 8.5.1, 8.5.2, 8.5.3, and 9.0 on Windows allows local users to dis CVE-2013-05234.3IBM WebSphere Commerce Enterprise 5.6.x through 5.6.1.5, 6.0.x through 6.0.0.11, and 7.0.x through 7.0.0.7 does not use a suitable encryptio CVE-2013-05251.5Multiple cross-site scripting (XSS) vulnerabilities in IBM iNotes 8.5.x allow local users to inject arbitrary web script or HTML via a share CVE-2013-05268.5ping.php in Global Console Manager 16 (GCM16) and Global Console Manager 32 (GCM32) before 1.20.0.22575 on the IBM Avocent 1754 KVM switch a CVE-2013-05271.9The Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not close pages upon the timeout of a session, w CVE-2013-05295.0The Browser in IBM Sterling Connect:Direct 1.4 before 1.4.0.11 and 1.5 through 1.5.0.1 does not set the secure flag for the session cookie i CVE-2013-05315.0The SSL implementation in IBM Security AppScan Enterprise before 8.7.0.1 enables cipher suites with weak encryption algorithms, which makes CVE-2013-05326.8Cross-site request forgery (CSRF) vulnerability in IBM Security AppScan Enterprise 5.6 and 8.x before 8.7 and IBM Rational Policy Tester 5.6 CVE-2013-05333.5Cross-site scripting (XSS) vulnerability in the Sametime Links server in IBM Sametime 8.0.2 through 8.5.2.1 allows remote authenticated user