Multiple vulnerabilities in IBM MobileFirst Platform Foundation

1) Input validation error

EUVDB-ID: #VU61720

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-22096

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to modify existing log records.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can pass specially crafted input to the application and inject arbitrary records into log files.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Code Injection

EUVDB-ID: #VU50896

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-23369

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Prototype Pollution

EUVDB-ID: #VU53013

Risk: High

CVSSv3.1: 7.3 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2021-23383

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when selecting certain compiling options to compile templates. A remote attacker can execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

4) Cross-site scripting

EUVDB-ID: #VU23929

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-20920

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Prototype pollution

EUVDB-ID: #VU88944

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22912

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can pass specially crafted input to the application and perform prototype pollution, which can result in information disclosure or data manipulation.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Cross-site request forgery

EUVDB-ID: #VU88942

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2013-6429

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to SourceHttpMessageConverter in Spring MVC in Spring Framework does not disable external entity resolution. A remote attacker can trick the victim into visiting a specially crafted web page to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper input validation

EUVDB-ID: #VU49739

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2020-5421

CWE-ID: CWE-20 - Improper input validation

Exploit availability: Yes

The vulnerability allows a remote authenticated user to read and manipulate data.

The vulnerability exists due to improper input validation within the Core (Spring Framework) component in Oracle Communications Session Report Manager. A remote authenticated user can exploit this vulnerability to read and manipulate data.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

8) Cross-site scripting

EUVDB-ID: #VU88940

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2013-6430

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to JavaScriptUtils.javaScriptEscape method in web/util/JavaScriptUtils.java in Spring MVC in Spring Framework does not properly escape certain characters. The vulnerability allows remote user to conduct cross-site scripting (XSS) attacks via a (1) line separator or (2) paragraph separator Unicode character or (3) left or (4) right angle bracket.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Command Injection

EUVDB-ID: #VU67516

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-42740

CWE-ID: CWE-77 - Command injection

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary commands on the system.

The vulnerability exists due to improper input validation in the regex designed to support Windows drive letters before passing it into the exec() call. A remote attacker can pass specially crafted payload to the application and execute arbitrary code on the system.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper privilege management

EUVDB-ID: #VU11753

Risk: Low

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-1272

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

The vulnerability allows a remote authenticated attacker to gain elevated privileges on the target system.

The weakness exists due to improper processing of multipart requests. A remote attacker can make a multipart request that injects malicious content to the target server, cause it to use wrong values and gain root privileges.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Cross-site request forgery

EUVDB-ID: #VU88957

Risk: Medium

CVSSv3.1: 6.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-0054

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

Exploit availability: No

The vulnerability allows a remote attacker to perform cross-site request forgery attacks.

The vulnerability exists due to Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework does not disable external entity resolution. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Configuration

EUVDB-ID: #VU88954

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2011-2730

CWE-ID: CWE-16 - Configuration

Exploit availability: No

The issue may allow a local user to bypass implemented security restrictions.

The issue exists due to the possibility to bypass implemented security restrictions, related to secure boot. it was addressed by rebuilding the package with the new secure boot key.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU88950

Risk: Medium

CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2013-7315

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to Spring MVC in Spring Framework does not disable external entity resolution for the StAX XMLInputFactory. A remote attacker can read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML with JAXB, aka an XML External Entity (XXE) issue.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) XXE attack

EUVDB-ID: #VU312

Risk: High

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2015-3192

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

The vulnerability allows a remote attacker to conduct XXe-attack on the target system.

The vulnerability exists in JBoss BPM Suite and BRMS. A remote attacker can cause denial of service conditions by submitting a specially crafted XML file that would cause out-of-memory errors when parsed.

Successful exploitation of this vulnerability may result in denial of service conditions on the target system.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) XML External Entity injection

EUVDB-ID: #VU88946

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2014-0225

CWE-ID: CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')

Exploit availability: No

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to application does not disable by default the resolution of URI references in a DTD declaration when processing user provided XML documents. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Infinite loop

EUVDB-ID: #VU23982

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-20922

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to infinite loop when processing specially-crafted templates. A remote attacker can consume all available system resources and cause denial of service conditions.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Code Injection

EUVDB-ID: #VU67517

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-10541

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation when processing the ">" and "<" operator used for redirection in shell. A remote attacker can pass specially crafted data to the application and execute arbitrary OS commands on the system.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Resource exhaustion

EUVDB-ID: #VU19282

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-1010266

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the software does not properly parse user-supplied input in the Date Handler component. A remote authenticated attacker can send long strings that submit malicious input, which the library attempts to match using a regular expression and consume excessive amounts of CPU resources and cause a DoS condition.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

19) Incorrect default permissions

EUVDB-ID: #VU48792

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-17521

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for temporary files and folders that are set by the application. A local user with access to the system can view contents of files and directories or modify them.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Privilege escalation

EUVDB-ID: #VU8911

Risk: Low

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2016-6814

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

The vulnerability allows a remote attacker to gain elevated privileges.

The weakness exists due to a flaw in the Oracle Enterprise Manager Ops Center Networking (Apache Groovy) component. A remote attacker can escalate his privileges on the target system.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Prototype pollution

EUVDB-ID: #VU55498

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-15366

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to execute arbitrary code.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can inject and execute arbitrary script code.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Command injection

EUVDB-ID: #VU11236

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2017-1000487

CWE-ID: CWE-77 - Command injection

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The weakness exists due to command injection when mishandling of double quoted strings. A remote attacker can submit specially crafted web content, inject and execute arbitrary commands.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Prototype polution

EUVDB-ID: #VU41989

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-8203

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when using _.zipObjectDeep in lodash. A remote attacker can inject and execute arbitrary script code.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Code Injection

EUVDB-ID: #VU21764

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2019-10744

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to modify properties on the target system.

The vulnerability exists due to improper input validation in the "defaultsDeep" function. A remote attacker can send a specially crafted request and modify the prototype of "Object" via "{constructor: {prototype: {...}}}" causing the addition or modification of an existing property that will exist on all objects.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

25) Code Injection

EUVDB-ID: #VU51945

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-23358

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Command Injection

EUVDB-ID: #VU53202

Risk: Medium

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-23337

CWE-ID: CWE-77 - Command injection

Exploit availability: No

The vulnerability allows a remote user to execute arbitrary commands on the system.

The vulnerability exists due to improper input validation when processing templates. A remote privileged user can inject and execute arbitrary commands on the system.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Input validation error

EUVDB-ID: #VU37072

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-3721

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote authenticated user to manipulate data.

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Incorrect Regular Expression

EUVDB-ID: #VU54394

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-28500

CWE-ID: CWE-185 - Incorrect Regular Expression

Exploit availability: No

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Prototype pollution

EUVDB-ID: #VU19305

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-16487

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation within the merge, mergeWith, and defaultsDeep functions. A remote attacker can send a specially crafted request and add or modify properties of Object.prototype.

Successful exploitation of this vulnerability may result in complete compromise of the affected application.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Code Injection

EUVDB-ID: #VU64034

Risk: High

CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-3918

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient sanitization of user-supplied data during the validation of a JSON object. A remote attacker can pass a specially crafted JSON file for validation and execute arbitrary code.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Prototype pollution

EUVDB-ID: #VU55264

Risk: Low

CVSSv3.1: 4.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-19919

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Install update from vendor's website.

MobileFirst Platform: before 8.0.0.0-MFPF-IF202301121031

• cpe:2.3:a:ibm_corporation:mobilefirst_platform:*:*:*:*:*:*:*:

http://www.ibm.com/support/pages/node/6857863

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.