CVE-2017-1407

CWE-77 — Command Injection3 documents3 sources
Severity
8.8HIGH
EPSS
3.9%
top 11.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
IBM Security Identity ManagerIBM Security Identity Governance AND IntelligenceIBM Security Privileged Identity Manager
Timeline
PublishedSep 28
Latest updateMay 13

Description

IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 127394.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5ibm/security_identity_manager6.0, 7.0+1
▶NVDibm/security_identity_manager6.0.0.0, 7.0.0.0+1
▶NVDibm/security_privileged_identity_manager2.0.0, 2.0.1, 2.0.2+2

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-qhxm-gpgw-m8pp: IBM Security Identity Manager Virtual Appliance 6↗2022-05-13
▶
CVEList
CVE-2017-1407: IBM Security Identity Manager Virtual Appliance 6↗2017-09-27
▶
CVE-2017-1407 (HIGH CVSS 8.8) | IBM Security Identity Manager Virtu | cvebase.io