CVE-2019-4038 Code injection in Security Identity Manager

High 7.2 Published 4 Feb 2019 Updated 17 Sep 2024

Attackers can inject code and bypass security checks in IBM Security Identity Manager by manipulating application control flow.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2019-4038?

CVE-2019-4038 is a high-severity code injection vulnerability in IBM Security Identity Manager, published on 4 Feb 2019. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the application, potentially bypassing security checks. Exploitation of this weakness can result in a limited form of code injection. IBM X-Force ID: 156162.

Weakness: CWE-94

Which versions are affected by CVE-2019-4038?

It affects 1 product.

Products include Ibm Security Identity Manager.

How do I fix CVE-2019-4038?

No fix has been published for CVE-2019-4038 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2019-4038 being exploited?

There is no known exploitation of CVE-2019-4038 in the wild and no public exploit code.

Sources

Also known as GHSA-4wxw-jxm6-5ch2.