PT-2017-10270 · Ibm · Ibm Business Process Manager

Nalla Muthu S + 1 · Publicado 2017-03-07 · Atualizado 2017-05-02 · CVE-2016-9693

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Business Process Manager versions 7.5 through 8.5

Description The issue allows an attacker to cause an unauthenticated victim to download a malicious payload, potentially bypassing existing file type restrictions. This could lead to the payload being considered executable and causing damage on the victim's machine.

Recommendations For IBM Business Process Manager versions 7.5 through 8.5, consider restricting the file download capability until a fix is available. As a temporary workaround, restrict access to the file download feature to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2016-9693

Produtos afetados

Ibm Business Process Manager

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-9693 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-9693 · Aviso do Fabricante
• https://ibm.com/support/docview.wss?uid=swg21998655 · Aviso do Fabricante
• http://securityfocus.com/bid/98074 · Nota