AIX Vulnerability Allows Non-Privileged Users to Execute Arbitrary Commands
CVE-2024-27260

8.4HIGH

Key Information:

Vendor
IBM
Status
Aix
Vendor
CVE Published:
16 May 2024

Summary

The vulnerability in IBM AIX and VIOS products potentially allows a non-privileged local user to leverage the invscout command for executing arbitrary commands on affected systems. This could lead to unauthorized access and manipulation of system resources, posing significant risks to data integrity and confidentiality. Effective security measures should be implemented to mitigate the potential exploitation of this vulnerability.

Affected Version(s)

AIX 7.2, 7.3, VIOS 3.1, VIOS 4.1

AIX cpe:2.3:o:ibm:aix:7.2:*:*:*:*:*:*:*

AIX cpe:2.3:o:ibm:aix:7.3:*:*:*:*:*:*:*

References

https://www.ibm.com/support/pages/node/7152543
vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/283985
vdb-entry

CVSS V3.1

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.