CVE-2017-1326

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

IBM Sterling File Gateway does not properly restrict user requests based on permission level. This allows for users to update data related to other users, by manipulating the parameters passed in the POST request. IBM X-Force ID: 126060.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
IBM	Sterling B2B Integrator	5.2; 5.2.1; 5.2.2; 5.2.3; 5.2.4; 5.2.5; 5.2.6

References

http://www.ibm.com/support/docview.wss?uid=swg22004274Patch, Vendor Advisory
http://www.securityfocus.com/bid/99183Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/126060VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22004274Patch, Vendor Advisory
http://www.securityfocus.com/bid/99183Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/126060VDB Entry, Vendor Advisory

Timeline

Published: Jun 22, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-132607.5In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote informatio CVE-2017-132617.5In bnep_process_control_packet of bnep_utils.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to re CVE-2017-132626.5In bnep_data_ind of bnep_main.cc, there is a possible out of bounds read due to a missing length decrement operation. This could lead to rem CVE-2017-132637.3A elevation of privilege vulnerability in the Android framework. Product: Android. Versions: 8.0, 8.1. Android ID: A-69383160.CVE-2017-132647.5A other vulnerability in the Android media framework (Avcdec). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android CVE-2017-132657.3A elevation of privilege vulnerability in the Android system (OTA updates). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android CVE-2017-132669.8In avrc_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible stack corruption due to a missing bounds check. This could lead to remote co CVE-2017-132679.8In avrc_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible stack corruption due to a missing bounds check. This could lead to remote es CVE-2017-132684.3A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, CVE-2017-132694.3A information disclosure vulnerability in the Android system (bluetooth). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, CVE-2017-13276.1IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web CVE-2017-132707.3A elevation of privilege vulnerability in the upstream kernel mnh_sm driver. Product: Android. Versions: Android kernel. Android ID: A-69474