IBM Security Information Queue (ISIQ) does not implement encoding or escaping of command requests that originate in the web UI. For example, it would be possible to intercept a product configuration request, and replace the product name with illegal characters. As of v1.0.6, ISIQ performs back-end validation to ensure that commands have not been tampered with.
Affected product(s) and affected version(s):
| Affected Product(s) | Version(s) |
| IBM Security Information Queue (ISIQ) | 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.5 |
Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: https://www.ibm.com/support/pages/node/6172587
The post Security Bulletin: Insufficient command validation in IBM Security Information Queue (CVE-2020-4282) appeared first on IBM PSIRT Blog.
from IBM Product Security Incident Response Team https://ift.tt/2y1CdKA
No comments:
Post a Comment
Note: Only a member of this blog may post a comment.