VIR Vulnerability Intelligence Relay

CVE-2015-4949

low
Published 2015-08-23 · Modified 2026-05-06
CVSS v3
—
CVSS v2
2.1
VIR risk
2.1

Description

IBM Tivoli Storage Manager for Databases: Data Protection for Microsoft SQL Server 7.1 before 7.1.2, Tivoli Storage Manager for Mail: Data Protection for Microsoft Exchange Server 7.1 before 7.1.2, and Tivoli Storage FlashCopy Manager 4.1 before 4.1.2 place cleartext passwords in exception messages, which allows physically proximate attackers to obtain sensitive information by reading GUI pop-up windows, a different vulnerability than CVE-2015-6557.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: psirt@us.ibm.com — http://www-01.ibm.com/support/docview.wss?uid=swg21963630

vendor Authored 2026-05-27

Vendor advisory: psirt@us.ibm.com — http://www-01.ibm.com/support/docview.wss?uid=swg1IT03480

Application impact
VendorProductVersionsFixed
ibm ibmtivoli_storage_flashcopy_manager4.1.0
ibm ibmtivoli_storage_flashcopy_manager4.1.2
ibm ibmtivoli_storage_manager_for_databases_data_protection_for_microsoft_sql_server7.1
ibm ibmtivoli_storage_manager_for_databases_data_protection_for_microsoft_sql_server7.2
ibm ibmtivoli_storage_manager_for_mail_data_protection_for_microsoft_exchange_server7.1
ibm ibmtivoli_storage_manager_for_mail_data_protection_for_microsoft_exchange_server7.2

References

CWEs

CWE-200

Verify integrity in audit chain (admin only). AS-IS.