The BIRT viewer in IBM Tivoli Application Dependency Discovery Manager (TADDM) 7.2.1.x before 7.2.1.5 allows remote authenticated users to bypass authorization checks and obtain report-administration privileges, and consequently create or delete reports or conduct SQL injection attacks, via crafted parameters to the BIRT reporting URL.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Tivoli_application_dependency_discovery_manager | Ibm | 7.2.1.1 (including) | 7.2.1.1 (including) |
| Tivoli_application_dependency_discovery_manager | Ibm | 7.2.1.2 (including) | 7.2.1.2 (including) |
| Tivoli_application_dependency_discovery_manager | Ibm | 7.2.1.3 (including) | 7.2.1.3 (including) |
| Tivoli_application_dependency_discovery_manager | Ibm | 7.2.1.4 (including) | 7.2.1.4 (including) |