Security restrictions bypass in IBM Algo Credit Manager

Published: 2018-06-14

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2018-2783 CVE-2018-2790
CWE-ID	CWE-264
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	IBM Algo Credit Manager Client/Desktop applications / Other client software
Vendor	IBM Corporation

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Security restrictions bypass

EUVDB-ID: #VU11946

Risk: Low

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-2783

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information and write arbitrary files on the target system.

The weakness exists in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE due to improper security restrictions. A remote attacker can create, delete or modify critical data or all Java SE, Java SE Embedded, JRockit accessible data and gain unauthorized access to critical data or complete access to all Java SE, Java SE Embedded, JRockit accessible data.

Mitigation

The vulnerability is fixed in the version 5.2.0.5.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4

External links

http://www-01.ibm.com/support/docview.wss?uid=swg22017118&myns=swgimgmt&mynp=OCSSNM52&mync=E&cm_sp=swgimgmt-_-OCSSNM52-_-E

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Security restrictions bypass

EUVDB-ID: #VU11947