CVE-2019-4236

Severity Score

4.4

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A IBM Spectrum Protect 7.l client backup or archive operation running for an HP-UX VxFS object is silently skipping Access Control List (ACL) entries from backup or archive if there are more than twelve ACL entries associated with the object in total. As a result, it could allow a local attacker to restore or retrieve the object with incorrect ACL entries. IBM X-Force ID: 159418.

Una operación de copia de seguridad o archivado del cliente Spectrum Protect de IBM versión 7.l que es ejecutado para un objeto HP-UX VxFS está omitiendo silenciosamente las entradas de la Lista de Control de Acceso (ACL) de copia de seguridad o el archivo si hay más de doce entradas de la ACL asociadas con el objeto en total. Como resultado, podría permitir que un atacante local restaure o recupere el objeto con entradas incorrectas de la ACL. ID de IBM X-Force: 159418.

*Credits: N/A

CVSS Scores

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2019-01-03 CVE Reserved
2019-07-22 CVE Published
2023-03-08 EPSS Updated
2024-09-16 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-19: Data Processing Errors

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://www.ibm.com/support/docview.wss?uid=ibm10884766	2022-12-02

URL	Date	SRC
https://exchange.xforce.ibmcloud.com/vulnerabilities/159418	2022-12-02

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Ibm Search vendor "Ibm"	Spectrum Protect Search vendor "Ibm" for product "Spectrum Protect"	>= 7.1.0.0 <= 7.1.8.5 Search vendor "Ibm" for product "Spectrum Protect" and version " >= 7.1.0.0 <= 7.1.8.5"	-	Affected	in	Hp Search vendor "Hp"	Hp-ux Search vendor "Hp" for product "Hp-ux"	-	-	Safe