CVE-2015-4950

MediumCVSS 4.0/10Last modified Jun 17, 2026

Description

The mailbox-restore feature in IBM Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 6.1 before 6.1.3.6, 6.3 before 6.3.1.3, 6.4 before 6.4.1.4, and 7.1 before 7.1.0.2; Tivoli Storage FlashCopy Manager: FlashCopy Manager for Microsoft Exchange Server 2.1, 2.2, 3.1 before 3.1.1.5, 3.2 before 3.2.1.7, and 4.1 before 4.1.1; and Tivoli Storage Manager FastBack for Microsoft Exchange 6.1 before 6.1.5.4 does not ensure that the correct mailbox is selected, which allows remote authenticated users to obtain sensitive information via a duplicate alias name.

Metrics

CVSS 2.0 4.0/10AV:N/AC:L/Au:S/C:P/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www-01.ibm.com/support/docview.wss?uid=swg1IT04251Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IT04252Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21963629Patch, Vendor Advisory
http://www.securitytracker.com/id/1033652
http://www-01.ibm.com/support/docview.wss?uid=swg1IT04251Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IT04252Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21963629Patch, Vendor Advisory
http://www.securitytracker.com/id/1033652

Timeline

Published: Aug 23, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-49515.3Client Acceptor Daemon (CAD) in the client in IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 and 6.x before 6.3.2.5, 6.4 before CVE-2015-49528.8The on-demand plugin in IBM Endpoint Manager for Remote Control 9.0.1 and 9.1.0 allows user-assisted remote attackers to execute arbitrary c CVE-2015-49534.8IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 makes it easier for man-in-the-middle attackers to decrypt traffi CVE-2015-49545.9IBM BigFix Remote Control before Interim Fix pack 9.1.2-TIV-IBRC912-IF0001 improperly allows self-signed certificates, which might allow rem CVE-2015-49553.5Cross-site scripting (XSS) vulnerability in IBM Business Process Manager (BPM) 8.0.x through 8.0.1.3, 8.5.0 through 8.5.0.1, 8.5.5 through 8 CVE-2015-49567.4The Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated users to execute unspecified OS commands vi CVE-2015-49575.4Cross-site scripting (XSS) vulnerability in the Web UI in IBM Security QRadar SIEM 7.1.x before 7.1 MR2 Patch 12 allows remote authenticated CVE-2015-49583.3IBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0 IF11, 11.3 before 11.3.0.0 IF7, and 11.4 befor CVE-2015-49596.1Cross-site scripting (XSS) vulnerability in IBM Tivoli Federated Identity Manager (TFIM) 6.2.2 before FP16 allows remote attackers to inject CVE-2015-49604.1IBM InfoSphere Master Data Management - Collaborative Edition 9.1, 10.1, 11.0 before 11.0.0.0 IF11, 11.3 before 11.3.0.0 IF7, and 11.4 befor CVE-2015-49612.6IBM Tealeaf Customer Experience 8.x before 8.7.1.8847 FP10, 8.8.x before 8.8.0.9049 FP9, 9.0.0 and 9.0.1 before 9.0.1.1117 FP5, 9.0.1A befor CVE-2015-49623.5Jazz Team Server in Jazz Foundation in IBM Rational Collaborative Lifecycle Management (CLM) 3.x and 4.x before 4.0.7 IF9, 5.x before 5.0.2