← Vulnerability feed

Vulnerability record · CVE-2014-3020 · published 29 July 2014

CVE-2014-3020: Ibm embedded websphere application server permissions and access controls vulnerability

Ibm · Embedded Websphere Application Server

install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program.

6.9 CVSS 2.0 Medium EPSS 0.32% · top 77.6% CWE-264 · Permissions and access controls
6.9CVSS 2.0 base score
0.32%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
16References
17 Jun 2026Last modified by NVD

Description

install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program.

AV:L/AC:M/Au:N/C:C/I:C/A:C

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://secunia.com/advisories/59687
http://secunia.com/advisories/59795
http://secunia.com/advisories/60552
http://www-01.ibm.com/support/docview.wss?uid=swg21679952 Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21680254
http://www-01.ibm.com/support/docview.wss?uid=swg21680841
http://www.securityfocus.com/bid/69034
https://exchange.xforce.ibmcloud.com/vulnerabilities/93056
http://secunia.com/advisories/59687
http://secunia.com/advisories/59795
http://secunia.com/advisories/60552
http://www-01.ibm.com/support/docview.wss?uid=swg21679952 Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21680254
http://www-01.ibm.com/support/docview.wss?uid=swg21680841
http://www.securityfocus.com/bid/69034
https://exchange.xforce.ibmcloud.com/vulnerabilities/93056

Track CVE-2014-3020 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2011-0732Ibm tivoli integrated portal vulnerabilityMultiple unspecified vulnerabilities in IBM Tivoli Integrated Portal (TIP) 1.1.1.1, as used in IBM Tivoli Common Reporting (TCR) 1.2.0 before Interim…EPSS 1.6%5.4CVE-2016-0303Ibm tivoli integrated portal cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in IBM Tivoli Integrated Portal 2.2.0.0 through 2.2.0.15 allows remote attackers to inject arbitrary web scr…EPSS 0.61%3.5CVE-2014-6151Ibm tivoli integrated portal improper input validation vulnerabilityCRLF injection vulnerability in IBM Tivoli Integrated Portal (TIP) 2.2.x allows remote authenticated users to inject arbitrary HTTP headers and condu…EPSS 0.96%3.5CVE-2014-6152Ibm tivoli integrated portal cross-site scripting vulnerabilityMultiple cross-site scripting (XSS) vulnerabilities in IBM Tivoli Integrated Portal (TIP) 2.2.x allow remote authenticated users to inject arbitrary …EPSS 0.95%5.1CVE-2015-3246libuser userhelper direct /etc/passwd write race conditionlibuser before 0.56.13-8 and 0.60 before 0.60-7, as used by the userhelper program in the usermode package, modifies /etc/passwd directly instead of …KEVEPSS 8.8%analysed6.6CVE-2015-1769Windows Mount Manager symlink mishandling allows local privilege escalationThe Windows Mount Manager mishandles symbolic links, allowing a crafted USB device to trigger arbitrary code execution. Because the flaw is in a core…KEVEPSS 4.1%analysed7.8CVE-2016-3643SolarWinds Virtualization Manager sudo misconfiguration privilege escalationSolarWinds Virtualization Manager 6.3.1 and earlier ship with a misconfigured sudo policy that lets a local user run privileged commands, as shown by…KEVEPSS 3.7%analysed

Source: NIST National Vulnerability Database (record CVE-2014-3020), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.