CVE-2017-1459

MediumCVSS 4.2/10Last modified Jun 17, 2026

Description

IBM Security Access Manager Appliance 8.0.0 and 9.0.0 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. IBM X-Force ID: 128378.

Metrics

CVSS 3.0 4.2/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-732

Affected software

Vendor	Product	Versions
IBM	Security Access Manager	9.0.0.1; 8.0.0; 8.0.0.1; 8.0.0.2; 8.0.0.3; 8.0.0.4; 8.0.0.5; 8.0.1; 8.0.1.2; 8.0.1.3; 8.0.1.4; 9.0.0; 9.0.1.0; 9.0.2.0; 8.0.1.5; 9.0.2.1; 9.0.3; 9.0.3.1; 8.0.1.6

References

http://www.ibm.com/support/docview.wss?uid=swg22012331Vendor Advisory
http://www.securitytracker.com/id/1040170Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/128378VDB Entry, Vendor Advisory
http://www.ibm.com/support/docview.wss?uid=swg22012331Vendor Advisory
http://www.securitytracker.com/id/1040170Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/128378VDB Entry, Vendor Advisory

Timeline

Published: Jan 10, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-145909.1Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker who has permission to cr CVE-2017-145919.0Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercuria CVE-2017-145928.8Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission t CVE-2017-145938.8Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission CVE-2017-145946.1The printable searchrequest issue resource in Atlassian Jira before version 7.2.12 and from version 7.3.0 before 7.6.1 allows remote attacke CVE-2017-145953.7In Joomla! before 3.8.0, a logic bug in a SQL query could lead to the disclosure of article intro texts when these articles are in the archi CVE-2017-145969.8In Joomla! before 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.CVE-2017-145974.8AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XSS via the txtDomainName field to adminpanel/modules/pro/inc/ajax.php during addi CVE-2017-14607.5IBM i OSPF 6.1, 7.1, 7.2, and 7.3 is vulnerable when a rogue router spoofs its origin. Routing tables are affected by a missing LSA, which m CVE-2017-146004.9Pragyan CMS v3.0 is vulnerable to an Error-Based SQL injection in cms/admin.lib.php via $_GET['del_black'], resulting in Information Disclos CVE-2017-146014.9Pragyan CMS v3.0 is vulnerable to a Boolean-based SQL injection in cms/admin.lib.php via $_GET['forwhat'], resulting in Information Disclosu CVE-2017-146027.2A vulnerability has been identified in the management interface of Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gate