Security Bulletin: Authenticated Users Can Gain Privilege in IBM UrbanCode Deploy (CVE-2017-1493)

Summary

Previous releases of IBM UrbanCode Deploy allow authenticated users to view and edit information they do not have permission to.

Vulnerability Details

CVEID: CVE-2017-1493 DESCRIPTION: IBM UrbanCode Deploy (UCD) could allow an authenticated user to edit objects that they should not have access to due to improper access controls.
CVSS Base Score: 4.3
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/128691&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)

Affected Products and Versions

All fixpacks of IBM UrbanCode Deploy 6.1 - 6.1.3.6 and IBM UrbanCode Deploy 6.2 - 6.2.6.1 are affected.

Remediation/Fixes

Upgrade to IBM UrbanCode Deploy 6.2.7.0 or later. If it is not possible to upgrade to 6.2.7.0, upgrade to IBM UrbanCode Deploy 6.1.3.7.

Workarounds and Mitigations

None