CVE-2016-5963 Code injection in n/a

What is CVE-2016-5963?

CVE-2016-5963 is a high-severity code injection vulnerability in n/a, published on 26 Sep 2016. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM Security Privileged Identity Manager (ISPIM) Virtual Appliance 2.x before 2.0.2 FP8 does not properly validate updates, which allows remote authenticated users to execute arbitrary code via unspecified vectors.

Weakness: CWE-284

Which versions are affected by CVE-2016-5963?

It affects 1 product.

Products include Ibm Security Privileged Identity Manager Virtual Appliance.

How do I fix CVE-2016-5963?

No fix has been published for CVE-2016-5963 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2016-5963 being exploited?

There is no known exploitation of CVE-2016-5963 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2016-5957 Weak cryptography in n/a High 7.5
• CVE-2016-5971 XML external entity in n/a High 7.1
• CVE-2016-3040 Open redirect in n/a Medium 6.8
• CVE-2016-5972 Missing authorization in n/a Medium 6.8
• CVE-2016-5970 Path traversal in n/a Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-gv5w-pw7q-p3gp.