CVE-2013-0517 Command injection in Sterling External Authentication Server

What is CVE-2013-0517?

CVE-2013-0517 is a high-severity command injection vulnerability in IBM Sterling External Authentication Server, published on 11 Feb 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A Command Execution Vulnerability exists in IBM Sterling External Authentication Server 2.2.0, 2.3.01, 2.4.0, and 2.4.1 via an unspecified OS command, which could let a local malicious user execute arbitrary code.

Weakness: CWE-78

Which versions are affected by CVE-2013-0517?

It affects 1 product.

Products include Ibm Sterling External Authentication Server.

How do I fix CVE-2013-0517?

No fix has been published for CVE-2013-0517 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2013-0517 being exploited?

There is no known exploitation of CVE-2013-0517 in the wild and no public exploit code.

Other vulnerabilities in IBM Sterling External Authentication Server

• CVE-2020-4462 XML external entity in External Authentication Server High 8.2
• CVE-2022-22336 Denial of service in Sterling Secure Proxy High 7.5
• CVE-2022-22333 Memory corruption in Sterling Secure Proxy Medium 6.5
• CVE-2021-29722 Weak cryptography in Sterling Secure Proxy Medium 5.9
• CVE-2021-29723 Weak cryptography in Sterling Secure Proxy Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jq67-2wg6-5wgp.