CVE-2015-5018

High

Published: 02/01/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

IBM Security Access Manager for Web versions 7.0.0 before FP19, 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1 allows remote authenticated users to execute arbitrary OS commands by leveraging Local Management Interface (LMI) access.

Risk Assessment

This vulnerability may lead to unauthorized access to the operating system, posing a serious threat to the integrity and confidentiality of data within the organization.

Recommendation

It is recommended to upgrade to the latest version of the software to mitigate this vulnerability and to restrict access to the Local Management Interface only to trusted users.

Other vulnerabilities in IBM Security Access Manager for Web, IBM Security Access Manager

CVE-2014-4823High
The administration console in IBM Security Access Manager for Web 7.x before 7.0.0-ISS-WGA-IF0009 and 8.x before 8.0.0-ISS-WGA-FP0005, and Security Access Manager for Mobile 8.x before 8.0.0-ISS-ISAM-FP0005, allows remote attackers to inject system commands via unspecified vectors.

Original NVD description (English source)

IBM Security Access Manager for Web 7.0.0 before FP19 and 8.0 before 8.0.1.3 IF3, and Security Access Manager 9.0 before 9.0.0.0 IF1, allows remote authenticated users to execute arbitrary OS commands by leveraging Local Management Interface (LMI) access.