Untrusted search path in IBM Java SDK - CVE-2019-4732
Published: June 13, 2023
Vulnerability identifier: #VU77190
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-4732
CWE-ID: CWE-426
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to execute arbitrary code on the target system.
The vulnerability exists due to DLL search order hijacking in Microsoft Windows client. A local privileged user can trick the victim into opening a specially-crafted file in a compromised folder and execute arbitrary code on the target system.
Affected software
IBM Java SDK
IBM Cloud Transformation Advisor
IBM CICS TX on Cloud
IBM Cloud Transformation Advisor
IBM CICS TX on Cloud
How to mitigate CVE-2019-4732
Install updates from vendor's website.
IBM Cloud Transformation Advisor - update to 2.1.1
IBM CICS TX on Cloud - update to 10.1.0.0 126165
IBM CICS TX on Cloud - update to 10.1.0.0 126165