CVE-2019-4561 Deserialization in Security Identity Manager

High 8.0 Published 20 Nov 2019 Updated 16 Sep 2024

Remote attackers can execute arbitrary code on IBM Security Identity Manager by tricking users into visiting malicious websites.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2019-4561?

CVE-2019-4561 is a high-severity unsafe deserialization vulnerability in IBM Security Identity Manager, published on 20 Nov 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

IBM Security Identity Manager 6.0.0 could allow a remote attacker to execute arbitrary code on the system, caused by the deserialization of untrusted data. By persuading a victim to visit a specially crafted Web site, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 166456.

Weakness: CWE-502

Which versions are affected by CVE-2019-4561?

It affects 1 product.

Products include Ibm Security Identity Manager.

How do I fix CVE-2019-4561?

No fix has been published for CVE-2019-4561 yet. Limit exposure of the affected software until one is available.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2019-4561 being exploited?

There is no known exploitation of CVE-2019-4561 in the wild and no public exploit code.

Sources

Also known as GHSA-h34j-m78p-92hp.