CVE-2017-1407

IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on…

High8.8EPSS 3.4%

Published: 27 Sept 2017
Updated: 17 Sept 2024
Reserved: 30 Nov 2016
Assigned by: ibm

Description

IBM Security Identity Manager Virtual Appliance 6.0 and 7.0 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 127394.

Timeline

2016
30 Nov 2016
30 Nov 2016
ID reserved
By ibm
2017
27 Sept 201710 months later
27 Sept 2017· 10 months later
Published
2024
17 Sept 20247 years later
17 Sept 2024· 7 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2017-1407, by who scored it
Scored by	CVSS	Score	Vector
NVDNVD · Modified	3.1	High8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS (exploitation in 30 days): 3.4% · top 11% of all CVEs (9 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.

Weakness

Gain Privileges
CWE-77 (opens in a new tab)All about CWE-77 and its CVEs

Affected products

IBM · Security Identity Manager
- affected 6.0
- affected 7.0

References (3)

http://www.ibm.com/support/docview.wss?uid=swg22007377 (opens in a new tab)x_refsource_CONFIRMx_transferred
101015 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
https://exchange.xforce.ibmcloud.com/vulnerabilities/127394 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2017-1407](https://cveledger.app/badge/CVE-2017-1407.svg)](https://cveledger.app/cve/CVE-2017-1407)

Record last updated 17 Sept 2024, 03:13 UTC.