CVE-2011-0489 EXPLOIT
7.5
HIGH · CVSS 2.0 · EPSS 12.6% (pctl 96)
Patch early
A public exploit exists.
Description
The server components in Objectivity/DB 10.0 do not require authentication for administrative commands, which allows remote attackers to modify data, obtain sensitive information, or cause a denial of service by sending requests over TCP to (1) the Lock Server or (2) the Advanced Multithreaded Server, as demonstrated by commands that are ordinarily sent by the (a) ookillls and (b) oostopams applications. NOTE: some of these details are obtained from third party information.
Scoring
| CVSS | 7.5 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| EPSS | 12.55% — more likely to be exploited than 96% of all CVEs |
| Weakness | CWE-287 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2011-01-18 |
| Last modified | 2026-06-16 |
Affected (1)
| Vendor | Product |
|---|---|
| objectivity | objectivity\/db |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Objectivity/DB - Lack of Authentication | 2011-01-14 |
References
- http://osvdb.org/70424
- http://secunia.com/advisories/42901
- http://www.exploit-db.com/exploits/15988
- http://www.kb.cert.org/vuls/id/782567
- http://www.securityfocus.com/bid/45803
- http://www.vupen.com/english/advisories/2011/0127
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64699
- http://osvdb.org/70424
- http://secunia.com/advisories/42901
- http://www.exploit-db.com/exploits/15988
- http://www.kb.cert.org/vuls/id/782567
- http://www.securityfocus.com/bid/45803
- http://www.vupen.com/english/advisories/2011/0127
- https://exchange.xforce.ibmcloud.com/vulnerabilities/64699
→ the Explorer · watch your stack · NVD