{"api_version":"1","generated_at":"2026-07-23T10:32:51+00:00","cve":"CVE-2019-4038","urls":{"html":"https://cve.report/CVE-2019-4038","api":"https://cve.report/api/cve/CVE-2019-4038.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-4038","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-4038"},"summary":{"title":"CVE-2019-4038","description":"IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the application, potentially bypassing security checks. Exploitation of this weakness can result in a limited form of code injection. IBM X-Force ID: 156162.","state":"PUBLIC","assigner":"psirt@us.ibm.com","published_at":"2019-02-04 21:29:00","updated_at":"2022-12-03 14:42:00"},"problem_types":["CWE-94"],"metrics":[],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/156162","name":"ibm-sim-cve20194038-code-injection(156162)","refsource":"XF","tags":["VDB Entry","Vendor Advisory"],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.ibm.com/support/docview.wss?uid=ibm10869604","name":"https://www.ibm.com/support/docview.wss?uid=ibm10869604","refsource":"CONFIRM","tags":["Patch","Vendor Advisory"],"title":"Security Bulletin: IBM Security Identity Manager is affected by a limited code injection vulnerability (CVE-2019-4038)","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-4038","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-4038","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"4038","vulnerable":"1","versionEndIncluding":"6.0.0.20","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_identity_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"4038","vulnerable":"1","versionEndIncluding":"7.0.1.10","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"security_identity_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"psirt@us.ibm.com","DATE_PUBLIC":"2019-02-01T00:00:00","ID":"CVE-2019-4038","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Security Identity Manager","version":{"version_data":[{"version_value":"6.0"},{"version_value":"7.0"}]}}]},"vendor_name":"IBM"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the application, potentially bypassing security checks. Exploitation of this weakness can result in a limited form of code injection. IBM X-Force ID: 156162."}]},"impact":{"cvssv3":{"BM":{"A":"H","AC":"L","AV":"P","C":"H","I":"H","PR":"H","S":"C","SCORE":"7.200","UI":"N"},"TM":{"E":"U","RC":"C","RL":"O"}}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Gain Access"}]}]},"references":{"reference_data":[{"name":"ibm-sim-cve20194038-code-injection(156162)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/156162"},{"name":"https://www.ibm.com/support/docview.wss?uid=ibm10869604","refsource":"CONFIRM","url":"https://www.ibm.com/support/docview.wss?uid=ibm10869604"}]}},"nvd":{"publishedDate":"2019-02-04 21:29:00","lastModifiedDate":"2022-12-03 14:42:00","problem_types":["CWE-94"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","attackVector":"PHYSICAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":6.2,"baseSeverity":"MEDIUM"},"exploitabilityScore":0.3,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:P","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":4.6},"severity":"MEDIUM","exploitabilityScore":3.9,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:security_identity_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0.0","versionEndIncluding":"6.0.0.20","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:security_identity_manager:*:*:*:*:*:*:*:*","versionStartIncluding":"7.0.0.0","versionEndIncluding":"7.0.1.10","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"4038","Ordinal":"141649","Title":"CVE-2019-4038","CVE":"CVE-2019-4038","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"4038","Ordinal":"1","NoteData":"IBM Security Identity Manager 6.0 and 7.0 could allow an attacker to create unexpected control flow paths through the application, potentially bypassing security checks. Exploitation of this weakness can result in a limited form of code injection. IBM X-Force ID: 156162.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"4038","Ordinal":"2","NoteData":"2019-02-04","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"4038","Ordinal":"3","NoteData":"2019-02-04","Type":"Other","Title":"Modified"}]}}}