7.2high
CVE-2016-6104
IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
7.2
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.7%
percentile 86%
Public exploits
0
none known
Summary
IBM Tivoli Key Lifecycle Manager 2.5, and 2.6 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions, which could allow the attacker to execute arbitrary code on the vulnerable system.
Exploit prediction (EPSS)
2.69% probability of exploitation in the next 30 days, higher than 86% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.2 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
Affected products
- IBM Corporation Key Lifecycle Manager
Classification
- Weakness
- CWE-434 Unrestricted Upload of File with Dangerous Type
References
- ibm.com /support/docview.wss?uid=swg21997988 · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/95980 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2016-6104
- NVD: CVE-2016-6104
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.