Description
IBM Sterling File Gateway does not properly restrict user requests based on permission level. This allows for users to update data related to other users, by manipulating the parameters passed in the POST request. IBM X-Force ID: 126060.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/99183
VDB Entry, Vendor Advisory x_refsource_misc
https://exchange.xforce.ibmcloud.com/vulnerabilities/126060
Patch, Vendor Advisory x_refsource_confirm
http://www.ibm.com/support/docview.wss?uid=swg22004274
Scores
CVSS v3
4.3
EPSS
0.0080
EPSS Percentile
51.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Details
CWE
CWE-269
Status
published
Products (8)
IBM/Sterling B2B Integrator
5.2
IBM/Sterling B2B Integrator
5.2.1
IBM/Sterling B2B Integrator
5.2.2
IBM/Sterling B2B Integrator
5.2.3
IBM/Sterling B2B Integrator
5.2.4
IBM/Sterling B2B Integrator
5.2.5
IBM/Sterling B2B Integrator
5.2.6
ibm/sterling_b2b_integrator
5.2
Published
Jun 22, 2017
Tracked Since
Feb 18, 2026