IBM Security Privileged Identity Manager Virtual Appliance path traversal

Summaryinfo

A vulnerability identified as critical has been detected in IBM Security Privileged Identity Manager Virtual Appliance 2.2.1. This affects an unknown function. The manipulation with the input /../ as part of Request leads to path traversal. This vulnerability is documented as CVE-2018-1618. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 and classified as critical. This issue affects some unknown functionality. The manipulation with the input value /../ leads to a path traversal vulnerability. Using CWE to declare the problem leads to CWE-22. The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. Impacted is confidentiality. The summary by CVE is:

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 144343.

The bug was discovered 03/29/2019. The weakness was released 04/02/2019 (Website). The advisory is shared at exchange.xforce.ibmcloud.com. The identification of this vulnerability is CVE-2018-1618 since 12/13/2017. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 08/21/2023). It is expected to see the exploit prices for this product increasing in the near future.MITRE ATT&CK project uses the attack technique T1006 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 4 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-132702, VDB-132703, VDB-132704 and VDB-132705. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• IBM

Name

• Security Privileged Identity Manager Virtual Appliance

Version

• 2.2.1

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion