Arbitrary file upload in Rational Publishing Engine - CVE-2016-2914
Published: August 8, 2016 / Updated: August 9, 2020
Vulnerability identifier: #VU40139
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-2914
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to manipulate or delete data.
Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows remote authenticated users to execute arbitrary code by specifying an unexpected file extension.
Affected software
Rational Publishing Engine
How to mitigate CVE-2016-2914
Install update from vendor's website.