IBM Rational Engineering Lifecycle Manager up to 6.0.6 Request improper authentication

Summaryinfo

A vulnerability labeled as critical has been found in IBM Rational Engineering Lifecycle Manager up to 6.0.6. This affects an unknown part. Executing a manipulation as part of Request can lead to improper authentication. This vulnerability is handled as CVE-2018-1539. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability has been found in IBM Rational Engineering Lifecycle Manager up to 6.0.6 and classified as critical. This vulnerability affects an unknown part. The manipulation as part of a Request leads to a improper authentication vulnerability. The CWE definition for the vulnerability is CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

IBM Rational Engineering Lifecycle Manager 5.0 through 5.02 and 6.0 through 6.0.6 could allow remote attackers to bypass authentication via a direct request or forced browsing to a page other than URL intended. IBM X-Force ID: 142561.

The bug was discovered 09/20/2018. The weakness was released 09/25/2018 (Website). The advisory is shared for download at exchange.xforce.ibmcloud.com. This vulnerability was named CVE-2018-1539 since 12/12/2017. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 05/19/2023). It is expected to see the exploit prices for this product increasing in the near future.

The vulnerability was handled as a non-public zero-day exploit for at least 5 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-124458, VDB-124459, VDB-124457 and VDB-124460. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• IBM

Name

• Rational Engineering Lifecycle Manager

Version

• 5.0
• 5.01
• 5.02
• 6.0
• 6.0.0
• 6.0.1
• 6.0.2
• 6.0.3
• 6.0.4
• 6.0.5
• 6.0.6

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion