DLL Search Order Hijacking Vulnerability in IBM i2 iBase Software
CVE-2020-4623

7.7HIGH

Key Information:

Vendor
IBM
Status
I2 Ibase
Vendor
CVE Published:
26 July 2021

Summary

A vulnerability exists in IBM i2 iBase 8.9.13, where a local authenticated attacker can exploit a DLL search order hijacking flaw. By utilizing a specially crafted .DLL file, an attacker could execute arbitrary code on the system, leading to potential unauthorized access or manipulation of the software environment. This flaw highlights the importance of proper DLL management and securing the paths from which DLL files are loaded to prevent such exploits.

Affected Version(s)

i2 iBase 8.9.13

References

https://www.ibm.com/support/pages/node/6474857
x_refsource_CONFIRM
https://exchange.xforce.ibmcloud.com/vulnerabilities/184984
vdb-entryx_refsource_XF

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.