PT-2019-9595 · Ibm · Ibm Financial Transaction Manager (Ftm) For Multi-Platform

Published 2019-09-18 · Updated 2019-10-09 · CVE-2018-1847

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) versions 2.0.0.0 through 2.0.0.5 IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) versions 2.1.0.0 through 2.1.0.4 IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) versions 2.1.1.0 through 2.1.1.4 IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) versions 3.0.0.0 through 3.0.0.8

Description The issue allows a remote attacker to traverse directories on the system by sending a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Recommendations For versions 2.0.0.0 through 2.0.0.5, update to a version outside of this range to mitigate the risk. For versions 2.1.0.0 through 2.1.0.4, update to a version outside of this range to mitigate the risk. For versions 2.1.1.0 through 2.1.1.4, update to a version outside of this range to mitigate the risk. For versions 3.0.0.0 through 3.0.0.8, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to sensitive files and directories to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-1847

Affected Products

Ibm Financial Transaction Manager (Ftm) For Multi-Platform

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/150946 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1847 · Vendor Advisory
• https://ibm.com/support/pages/security-bulletin-path-traversal-exposure-saveexport-function-ftm-oac · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1847 · Security Note