IBM Security Bulletin: Daeja ViewONE arbitrary files can be accessed

IBM Daeja ViewONE Standard, Professional & Virtual could allow an authenticated attacker to download files they should not have access to due to improper access controls.

CVE(s): CVE-2017-1308

Affected product(s) and affected version(s):

IBM Daeja ViewONE Standard, Professional & Virtual 4.1.5 – 4.1.5.1
IBM Daeja ViewONE Virtual 5.0

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://ift.tt/2uQLxeh
X-Force Database: http://ift.tt/2uityjZ

The post IBM Security Bulletin: Daeja ViewONE arbitrary files can be accessed appeared first on IBM PSIRT Blog.

from IBM Product Security Incident Response Team http://ift.tt/2uRcoqN