#VU15959 Privilege escalation in IBM Algo Credit Manager - CVE-2018-12539

Vulnerability identifier: #VU15959

Vulnerability risk: Low

CVSSv4.0: 6.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-12539

CWE-ID: CWE-264

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
IBM Algo Credit Manager
Client/Desktop applications / Other client software

Vendor: IBM Corporation

Description
The vulnerability allows a local unauthenticated attacker to gain elevated privileges on the target system.

The weakness exists due to the failure to restrict the use of Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations to only the process owner. A local attacker can conduct directory traversal attack and extract compressed dump files.

Mitigation
The vulnerability has been fixed in the versions 5.2.0.5 IF6, 5.3.0.5 IF12, 5.4.3 IF 2.

Vulnerable software versions

IBM Algo Credit Manager: 5.2 - 5.4.3

---

External links
https://www-01.ibm.com/support/docview.wss?uid=ibm10728567&myns=swgimgmt&mynp=OCSSNM...

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.