Security Bulletin: Plugins can be uploaded to IBM UrbanCode Deploy without Authentication (CVE-2017-1749)

Summary

A directory traversal attack can be used to upload new versions of a plugin, altering UCD deployments.

Vulnerability Details

CVEID: CVE-2017-1749 DESCRIPTION: IBM UrbanCode Deploy could allow a remote attacker to traverse directories on the system. An unauthenticated attacker could alter UCD deployments.
CVSS Base Score: 5.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/135522 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

All fixpacks of IBM UrbanCode Deploy 6.1 - 6.1.3.6 and IBM UrbanCode Deploy 6.2 - 6.2.6.1 are affected.

Remediation/Fixes

Upgrade to IBM UrbanCode Deploy 6.2.7.0 or later. If it is not possible to upgrade to 6.2.7.0, upgrade to IBM UrbanCode Deploy 6.1.3.7 or later.

Workarounds and Mitigations

None