CVE-2016-0324: Command Injection

Published Jan 12, 2018

Updated

IBM Security Identity Manager (ISIM) Virtual Appliance 7.0.0.0 through 7.0.1.0 before 7.0.1-ISS-SIM-FP0001 allows remote authenticated users to execute arbitrary code with administrator privileges via unspecified vectors. IBM X-Force ID: 111640.

Affected Software

5 affected components

IBM Security Identity Manager Virtual Appliance=7.0.0.0

IBM Security Identity Manager Virtual Appliance=7.0.0.1

IBM Security Identity Manager Virtual Appliance=7.0.0.2

IBM Security Identity Manager Virtual Appliance=7.0.0.3

IBM Security Identity Manager Virtual Appliance=7.0.1.0

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21981438

Event History

Jan 12, 2018

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the vulnerability ID for this security issue?

The vulnerability ID for this security issue is CVE-2016-0324.

What software is affected by this vulnerability?

IBM Security Identity Manager (ISIM) Virtual Appliance versions 7.0.0.0 through 7.0.1.0 are affected.

What is the severity of CVE-2016-0324?

The severity of CVE-2016-0324 is critical with a severity score of 8.8.

How can remote authenticated users exploit this vulnerability?

Remote authenticated users can exploit this vulnerability to execute arbitrary code with administrator privileges through unspecified vectors.

Is there a fix available for this vulnerability?

Yes, IBM has released a fix for this vulnerability. Please refer to the official IBM Security Identity Manager support page for more information.