VulnerabilityModified
CVE-2019-4541
IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity.
HIGH 7.2EPSS 1.32%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.32%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
IBM Security Directory Server 6.4.0 uses incomplete blacklisting for input validation which allows attackers to bypass application controls resulting in direct impact to the system and data integrity. IBM X-Force ID: 165814.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.32% probability · 69th percentile
- CISA KEV
- Not listed
- Affected
- ibm/security directory server
- Source
- psirt@us.ibm.com
References
- https://exchange.xforce.ibmcloud.com/vulnerabilities/165814VDB Entry
- https://www.ibm.com/support/pages/node/1288660Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/165814VDB Entry
- https://www.ibm.com/support/pages/node/1288660Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.