IBM Case Manager CVE-2018-1884 Arbitrary File Overwrite Vulnerability

Bugtraq ID:	105946
Class:	Design Error
CVE:	CVE-2018-1884
Remote:	Yes
Local:	No
Published:	Nov 30 2018 12:00AM
Updated:	Nov 30 2018 12:00AM
Credit:	IBM
Vulnerable:	IBM Case Manager 5.3.3 0 IBM Case Manager 5.3 0 IBM Case Manager 5.2.1 IBM Case Manager 5.2 IBM Case Manager 5.2.1.7 IBM Case Manager 5.2.1.5 IBM Case Manager 5.2.1.0 IBM Case Manager 5.2.0.4 IBM Case Manager 5.2.0.0 IBM Case Manager 5.1.1
Not Vulnerable:

IBM Case Manager CVE-2018-1884 Arbitrary File Overwrite Vulnerability

IBM Case Manager is prone to an arbitrary file-overwrite vulnerability.

Remote attackers may use a specially crafted request with directory-traversal sequences ('../') to overwrite arbitrary files on the affected computer and execute arbitrary code with the privileges of the user running the affected application.

IBM Case Manager CVE-2018-1884 Arbitrary File Overwrite Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM Case Manager CVE-2018-1884 Arbitrary File Overwrite Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM Case Manager CVE-2018-1884 Arbitrary File Overwrite Vulnerability

References:

• IBM Homepage (IBM)
  
• Security Bulletin: Security Bulletin: A Zip Slip vulnerability is exposed in Cas (IBM)