CVE-2017-1190 Code injection in Emptoris Strategic Supply Management
A local attacker with special roles can execute arbitrary code by manipulating a configurable property, gaining full system control.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-1190?
CVE-2017-1190 is a medium-severity code injection vulnerability in IBM Emptoris Strategic Supply Management, published on 14 Aug 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
IBM Emptoris Strategic Supply Management Platform 10.x and 10.1 could allow a local user with special access roles to execute arbitrary code on the system. By manipulating a configurable property, an attacker could exploit this vulnerability to gain full control over the system. IBM X-Force ID: 123559.
Which versions are affected by CVE-2017-1190?
It affects 1 product.
Products include Ibm Emptoris Strategic Supply Management.
How do I fix CVE-2017-1190?
No fix has been published for CVE-2017-1190 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-1190 being exploited?
There is no known exploitation of CVE-2017-1190 in the wild and no public exploit code.
Other vulnerabilities in IBM Emptoris Strategic Supply Management
- CVE-2017-1097 Cross-site request forgery in Emptoris Strategic Supply Management
- CVE-2016-8951 Denial of service in Emptoris Strategic Supply Management
- CVE-2020-4895 Cross-site scripting in Emptoris Sourcing
- CVE-2020-4893 Information disclosure in Emptoris Strategic Supply Management
- CVE-2020-4898 Weak cryptography in Emptoris Strategic Supply Management
Sources
Also known as GHSA-g7wr-fmqf-mf59.