CVE-2019-4732 Other in Java
A local attacker can execute arbitrary code via DLL search order hijacking in the IBM Java SDK on Windows.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-4732?
CVE-2019-4732 is a high-severity vulnerability in Ibm Websphere Application Server, published on 3 Feb 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.
Weakness: CWE-426
Which versions are affected by CVE-2019-4732?
It affects 2 products.
Products include Ibm Sdk, Ibm Websphere Application Server.
How do I fix CVE-2019-4732?
Upgrade to a fixed version.
Is CVE-2019-4732 being exploited?
There is no known exploitation of CVE-2019-4732 in the wild and no public exploit code.
Other vulnerabilities in Ibm Websphere Application Server
Sources
Also known as GHSA-764v-x3h3-f6pj.