PT-2020-10999 · Ibm · Ibm Security Secret Server

Published 2020-01-28 · Updated 2020-08-24 · CVE-2019-4635

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Secret Server version 10.7

Description The issue allows a privileged user to perform unauthorized command injection due to improper input neutralization of special elements.

Recommendations For IBM Security Secret Server version 10.7, consider restricting access to privileged user accounts until a patch is available. As a temporary workaround, ensure proper input validation and sanitization of special elements to minimize the risk of command injection.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2019-4635

Affected Products

Ibm Security Secret Server

References · 5

• https://exchange.xforce.ibmcloud.com/vulnerabilities/170011 · Vendor Advisory
• https://ibm.com/support/pages/node/1283212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4635 · Security Note
• https://osv.dev/vulnerability/CVE-2019-4635 · Vendor Advisory
• https://t.me/cvenotify/553 · Telegram Post