IBM31338194CFFB21A8D792EC0891A93A20D5EA690FA540B623C5E2FEB658219248Security Bulletin: Embedded WebSphere Application Server is vulnerable to a remote command execution vulnerability affects Content Collector for Email
EPSS
Percentile
5.1%
Summary
IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted UNC path, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges. IBM X-Force ID: 182808
Vulnerability Details
CVEID:CVE-2020-4534
**DESCRIPTION:**IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted UNC path, an attacker could exploit this vulnerability to execute arbitrary code with higher privileges. IBM X-Force ID: 182808.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/182808 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| Content Collector for Email | 4.0.1 |
Remediation/Fixes
| Product | VRM | Remediation |
|---|---|---|
| Content Collector for Email | 4.0.1 | Use Content Collector for Email 4.0.1.9 Interim Fix IF007 |
Workarounds and Mitigations
None
Related
