Arbitrary file upload in Rational Publishing Engine - CVE-2016-2914

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU40139

Arbitrary file upload in Rational Publishing Engine - CVE-2016-2914

Published: August 8, 2016 / Updated: August 9, 2020


Vulnerability identifier: #VU40139
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2016-2914
CWE-ID: CWE-434
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vendor: IBM Corporation
Affected software:
Rational Publishing Engine

Detailed vulnerability description

The vulnerability allows a remote authenticated user to manipulate or delete data.

Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows remote authenticated users to execute arbitrary code by specifying an unexpected file extension.


How to mitigate CVE-2016-2914

Install update from vendor's website.

Sources