Security Bulletin: Remote code execution possible due to insecure REST endpoint (CVE-2016-8938)

Summary IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server. This code could be executed on the UCD agent machines that host customer's production applications. Vulnerability Details CVEID: CVE-2016-8938 DESCRIPTION:...

CVE-2016-8938

CVE-2016-8938 affects IBM UrbanCode Deploy (UCD). The vulnerability allows remote code execution via a crafted file upload that replaces server code, with potential execution on UCD agent machines hosting production apps. IBM’s advisory lists affected versions (e.g., 6.0.x, 6.1.x, 6.2.x lines) an...