Lock Bypass in IBM PureApplication System Leading to Pattern Modification
CVE-2019-4234

4.3MEDIUM

Key Information:

Vendor
IBM
Status
Pureapplication System
Vendor
CVE Published:
26 June 2019

Summary

A weakness in the locking feature implementation of the pattern editor in IBM PureApplication System versions 2.2.3.0 through 2.2.5.3 allows attackers to intercept subsequent requests. This enables them to bypass business logic, modifying the pattern to an unlocked state and potentially compromising the integrity of the application.

Affected Version(s)

PureApplication System 2.2.3.0

PureApplication System 2.2.3.1

PureApplication System 2.2.3.2

References

https://www-01.ibm.com/support/docview.wss?uid=ibm10885602
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/159416
vdb-entryx_refsource_XF

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.