CVE-2016-3028 Command injection in n/a
Authenticated administrators can execute arbitrary commands on IBM Security Access Manager for Web servers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-3028?
CVE-2016-3028 is a critical command injection vulnerability in n/a, published on 25 Nov 2016. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
IBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authenticated users to execute arbitrary commands by leveraging LMI admin access.
Weakness: CWE-78
Which versions are affected by CVE-2016-3028?
It affects 2 products.
Products include Ibm Security Access Manager, Ibm Security Access Manager for Web.
How do I fix CVE-2016-3028?
No fix has been published for CVE-2016-3028 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2016-3028 being exploited?
There is no known exploitation of CVE-2016-3028 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-1722 Code injection in Security Access Manager Appliance
- CVE-2018-1850 Missing authorization in Security Access Manager Appliance
- CVE-2016-3025 Security feature bypass in n/a
- CVE-2023-30997 IBM Security Access Manager Docker privilege escalation
- CVE-2023-30998 IBM Security Access Manager Docker privilege escalation
Sources
Also known as GHSA-4f8w-48h8-77c3.