CSV Injection Vulnerability in IBM WebSphere Automation Could Lead to Arbitrary Command Execution
CVE-2024-28764

7.8HIGH

Key Information:

Vendor
IBM
Status
Websphere Automation
Vendor
CVE Published:
1 May 2024

Summary

The IBM WebSphere Automation 1.7.0 is susceptible to a CSV injection vulnerability that could let an attacker with special network privileges execute arbitrary commands. This issue arises from the system's failure to correctly validate the contents of CSV files. If exploited, this vulnerability could lead to unauthorized actions and further compromise the system's integrity.

Affected Version(s)

WebSphere Automation 1.7.0

References

https://www.ibm.com/support/pages/node/7149857
vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/285623
vdb-entry

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.