IBM TRIRIGA Application Platform 3.5.3 and 3.6.0 could disclose sensitive information to an authenticated user that could aid in further att

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• ibm tririga application platform3.5.3.0 and later · before 3.5.3.6
• ibm tririga application platform3.6.0.0 and later · before 3.6.0.3

Versions reported by the vendor

Affected version ranges reported by the assigning authority (ibm). Independent of NVD's CPE analysis and usually ahead of it.

• IBM TRIRIGA Application Platform

  • 3.5.3, 3.6.0affected

Other highest-scoring records for the same primary product.

• CVE-2017-1373Reports executed in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated user t
  36Monitor
• CVE-2017-1371Builder tools running in the IBM TRIRIGA Application Platform 3.3, 3.4, and 3.5 contains a vulnerability that could allow an authenticated u
  35Monitor
• CVE-2017-1153IBM TRIRIGA Report Manager 3.2 through 3.5 contains a vulnerability that could allow an authenticated user to execute actions that they do n
  35Monitor
• CVE-2016-2917The notifications component in IBM TRIRIGA Applications 10.4 and 10.5 before 10.5.1 allows remote authenticated users to obtain sensitive pa
  35Monitor
• CVE-2016-0374The builder tools in IBM TRIRIGA Application Platform 3.3 before 3.3.2.6, 3.4 before 3.4.2.4, and 3.5 before 3.5.0.2 allow remote authentica
  35Monitor
• CVE-2016-0348Cross-site request forgery (CSRF) vulnerability in IBM TRIRIGA Application Platform 3.3, 3.3.1, 3.3.2, and 3.4 allows remote attackers to hi
  32Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.