PT-2019-9890 · Ibm · Ibm Security Identity Manager

Chris Shepherd + 5 · Published 2019-01-14 · Updated 2019-10-09 · CVE-2018-1969

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Security Identity Manager version 6.0.0

Description The issue allows an attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

Recommendations For IBM Security Identity Manager version 6.0.0, consider restricting file uploads to only safe and necessary file types until a patch is available. As a temporary workaround, disabling automatic file processing can help minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-1969

Affected Products

Ibm Security Identity Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-1969 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1969 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/153750 · Vendor Advisory
• https://ibm.com/support/docview.wss?uid=ibm10794615 · Vendor Advisory
• http://securityfocus.com/bid/106554 · Note