IBM Security Bulletin: IBM® Intelligent Operations Center does not correctly validate file types before uploading files (CVE-2019-4069)

IBM® Intelligent Operations Center does not validate the content of CSV files that are uploaded by authenticated users. The upload of unvalidated CSV files by authenticated users might be a starting point for further attacks if it is combined with file renaming or other inclusion techniques.

CVE(s): CVE-2019-4069

Affected product(s) and affected version(s):
This vulnerability affects the following products and versions:

• IBM® Intelligent Operations Center V5.1.0 – V5.2.0
• IBM® Intelligent Operations Center for Emergency Management V5.1.0 – V5.1.0.6
• IBM® Water Operations for Waternamics V5.1.0 – V5.2.1.1

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: https://www-01.ibm.com/support/docview.wss?uid=ibm10879953
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/157014

The post IBM Security Bulletin: IBM® Intelligent Operations Center does not correctly validate file types before uploading files (CVE-2019-4069) appeared first on IBM PSIRT Blog.

from IBM Product Security Incident Response Team https://ibm.co/2EXvdiy