CVE-2010-4121

HIGH

7.5

CVSS Severity Score

EPSS Score0.0230%

EPSS Percentile2.38th

PublishedOct 28, 2010

Last ModifiedApr 29, 2026

Vulnerability Description

The TCP-to-ODBC gateway in IBM Tivoli Provisioning Manager for OS Deployment 7.1.1.3 does not require authentication for SQL statements, which allows remote attackers to modify, create, or read database records via a session on TCP port 2020. NOTE: the vendor disputes this issue, stating that the "default Microsoft Access database is not password protected because it is intended to be used for evaluation purposes only.

Affected Platforms (CPE)

📦

Ibm

Tivoli Provisioning Manager Os Deployment

= 7.1.1.3

References & Advisories

🔗 http://publib.boulder.ibm.com/infocenter/tivihelp/v3r1/index.jsp?topic=%2Fcom.ibm.tivoli.tpm.osd.doc%2Finstall%2Ftosd_setmsacessdbpwd.html

🔗 http://securitytracker.com/id?1024539

🔗 http://www.zerodayinitiative.com/advisories/ZDI-10-194