CVE-2023-45188 — MEDIUM (6.5)

Vulnerability Description

IBM Engineering Lifecycle Optimization Publishing 7.0.2 and 7.03 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially crafted request, a remote attacker could exploit this vulnerability to upload a malicious file, which could allow the attacker to execute arbitrary code on the vulnerable system. IBM X-Force ID: 268751.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Ibm	Engineering Lifecycle Optimization Publishing	7.0.2
Linux	Linux Kernel	-
Microsoft	Windows	-

Related Weaknesses (CWE)

CWE-434

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/268751Vendor Advisory
https://www.ibm.com/support/pages/node/7156757Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/268751Vendor Advisory
https://www.ibm.com/support/pages/node/7156757Vendor Advisory

FAQ

What is CVE-2023-45188?

CVE-2023-45188 is a vulnerability with a CVSS score of 6.5 (MEDIUM). IBM Engineering Lifecycle Optimization Publishing 7.0.2 and 7.03 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially ...

How severe is CVE-2023-45188?

CVE-2023-45188 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2023-45188?

Check the references section above for vendor advisories and patch information. Affected products include: Ibm Engineering Lifecycle Optimization Publishing, Linux Linux Kernel, Microsoft Windows.