{"vuid":"VU#442595","idnumber":"442595","name":"ScrumWorks Pro privilege escalation vulnerability","keywords":["scrumworks","privilege","escalation"],"overview":"ScrumWorks Pro versions prior to ScrumWorks Pro 6.0 contain a privilege escalation vulnerability.","clean_desc":"ScrumWorks Pro versions prior to ScrumWorks Pro 6.0 contain a privilege escalation vulnerability where a malicious user can escalate the privileges of their ScrumWorks Pro account by recompiling the desktop client. When exploited, a malicious user could grant themselves ScrumWorks Pro privileges and access information to which they would otherwise be unable to access.","impact":"A malicious user can escalate the privileges of their ScrumWorks Pro account by recompiling the desktop client.","resolution":"Update CollabNet has stated: CollabNet has addressed this problem in release 6.0 such that a modified client is no longer effective in escalating permissions. Note for all versions of ScrumWorks Pro, this security issue does not compromise the security of the underlying host operating system and that a modified client does not negate the need for a valid username and password. Further, all activities by modified clients are still logged in the server.log file.","workarounds":"","sysaffected":"","thanks":"Thanks to Wolfgang Holoch and David Elze of Daimler TSS GmbH for reporting this vulnerability.","author":"This document was written by Michael Orlando.","public":["h","t","t","p",":","/","/","w","w","w",".","c","o","l","l","a","b",".","n","e","t","/","p","r","o","d","u","c","t","s","/","s","c","r","u","m","w","o","r","k","s"],"cveids":["CVE-2012-2603"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2012-02-16T17:40:31Z","publicdate":"2012-06-04T00:00:00Z","datefirstpublished":"2012-06-07T11:16:52Z","dateupdated":"2012-06-07T11:16:53Z","revision":11,"vrda_d1_directreport":"1","vrda_d1_population":"3","vrda_d1_impact":"3","cam_widelyknown":"0","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"0","cam_impact":"0","cam_easeofexploitation":"0","cam_attackeraccessrequired":"0","cam_scorecurrent":"0","cam_scorecurrentwidelyknown":"0","cam_scorecurrentwidelyknownexploited":"0","ipprotocol":"","cvss_accessvector":"N","cvss_accesscomplexity":"H","cvss_authentication":null,"cvss_confidentialityimpact":"C","cvss_integrityimpact":"P","cvss_availabilityimpact":"N","cvss_exploitablity":null,"cvss_remediationlevel":"OF","cvss_reportconfidence":"C","cvss_collateraldamagepotential":"L","cvss_targetdistribution":"L","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"5.6","cvss_basevector":"AV:N/AC:H/Au:S/C:C/I:P/A:N","cvss_temporalscore":"4.4","cvss_environmentalscore":"1.2","cvss_environmentalvector":"CDP:L/TD:L/CR:ND/IR:ND/AR:ND","metric":0.0,"vulnote":null}