Medium severity · published Jun 26, 2019
CVE-2019-4234
IBM PureApplication System 2.2.3.0 through 2.2.5.3 weakness in the implementation of locking feature in pattern editor
4.3
CVSS
0.9%
EPSS
No
On KEV
Description
IBM PureApplication System 2.2.3.0 through 2.2.5.3 weakness in the implementation of locking feature in pattern editor. An attacker by intercepting the subsequent requests can bypass business logic to modify the pattern to unlocked state. IBM X-Force ID: 159416.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PS
Pureapplication System · Ibm
2.2.3.0 through 2.2.5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-4234
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-4234
VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/159416
Patch
https://www-01.ibm.com/support/docview.wss?uid=ibm10885602
More from Pureapplication System
9.8
CVE-2014-7169
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
9.8
CVE-2014-6271
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
8.8
CVE-2019-4224
IBM PureApplication System 2.2.3.0 through 2.2.5.3 is vulnerable to SQL injection
7.8
CVE-2019-4241
IBM PureApplication System 2.2.3.0 through 2.2.5.3 could allow an authenticated user with local access to bypass authentication and obtain administrative access
7.5
CVE-2019-4235
IBM PureApplication System 2.2.3.0 through 2.2.5.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user…