PT-2018-12567 · Ibm · Ibm Security Identity Manager Virtual Appliance

Published 2018-06-08 · Updated 2019-10-09 · CVE-2018-1453

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Security Identity Manager Virtual Appliance version 7.0

Description The issue allows an authenticated attacker to upload or transfer files of dangerous types that can be automatically processed within the environment.

Recommendations For IBM Security Identity Manager Virtual Appliance version 7.0, consider restricting file uploads to only safe and necessary file types until a patch is available. As a temporary workaround, implement additional validation and sanitization for uploaded files to prevent automatic processing of dangerous file types.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-1453

Affected Products

Ibm Security Identity Manager Virtual Appliance

References · 5

• http://ibm.com/support/docview.wss?uid=swg22013617 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/140055 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1453 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1453 · Security Note
• http://securitytracker.com/id/1041383 · Note