CVE-2016-5990

CWE-284 — Improper Access Control3 documents3 sources

Severity

6.3MEDIUM

EPSS

0.2%

top 58.76%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

IBM Corporation Privileged Identity Manager IBM Security Privileged Identity Manager

Timeline

PublishedFeb 1

Latest updateMay 17

Description

IBM Security Privileged Identity Manager Virtual Appliance allows an authenticated user to upload malicious files that would be automatically executed by the server.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.4

Affected Packages2 packages

▶NVDibm/security_privileged_identity_manager2.0.2, 2.1+1

▶CVEListV5ibm_corporation/privileged_identity_manager6 versions+5

Patches

Patch: www.ibm.com ↗Patch: www.securityfocus.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

GHSA

GHSA-gxx5-h743-7mxx: IBM Security Privileged Identity Manager Virtual Appliance allows an authenticated user to upload malicious files that would be automatically executed↗2022-05-17

▶

CVEList

CVE-2016-5990: IBM Security Privileged Identity Manager Virtual Appliance allows an authenticated user to upload malicious files that would be automatically executed↗2017-02-01

▶