Security Bulletin: IBM Security Identity Manager is affected by a limited code injection vulnerability (CVE-2019-4038)

Summary

IBM Security Identity Manager (ISIM) has addressed the following vulnerability that can allow attackers to compromise user accounts via limited code injection.

Vulnerability Details

CVEID: CVE-2019-4038 DESCRIPTION: IBM Security Identity Manager could allow an attacker to create unexpected control flow paths through the application, potentially bypassing security checks. Exploitation of this weakness can result in a limited form of code injection.
CVSS Base Score: 7.2
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/156162&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

IBM Security Identity Manager

|

6.0.0 - 6.0.0.20

|

6.0.0-ISS-SIM-FP0021

IBM Security Identity Manager | 7.0.0 - 7.0.1.10 |

7.0.1-ISS-SIM-FP0011