CVE-2017-1407: Command Injection

Published Sep 27, 2017

Updated

IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 127394.

Affected Software

7 affected components

IBM Security Identity Governance and Intelligence=5.2.0

IBM Security Identity Governance and Intelligence=5.2.1

IBM Security Identity Manager=6.0.0.0

IBM Security Identity Manager=7.0.0.0

IBM Security Privileged Identity Manager=2.0.0

IBM Security Privileged Identity Manager=2.0.1

IBM Security Privileged Identity Manager=2.0.2

Remediation

Patch Available

http://www.ibm.com/support/docview.wss?uid=swg22007377

Event History

Sep 27, 2017

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-1407?

The severity of CVE-2017-1407 is considered high due to its potential for remote command execution.

How do I fix CVE-2017-1407?

To fix CVE-2017-1407, it is recommended to apply the latest patches provided by IBM for affected versions of the software.

Which systems are affected by CVE-2017-1407?

CVE-2017-1407 affects IBM Security Identity Manager versions 6.0 and 7.0 as well as certain versions of IBM Security Governance and Intelligence.

Can CVE-2017-1407 be exploited remotely?

Yes, CVE-2017-1407 can be exploited by a remote authenticated attacker through specially-crafted requests.

What actions can an attacker perform using CVE-2017-1407?

An attacker exploiting CVE-2017-1407 could execute arbitrary commands on the affected system.