CVE-2016-2914

Published: Aug 8, 2016Modified: May 6, 2026

5.4

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Exploitability: 2.8 / Impact: 2.5

Source: NVD

Description

Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows remote authenticated users to execute arbitrary code by specifying an unexpected file extension.

Affected (1)

Products: Ibm: Engineering Lifecycle Optimization Publishing

Ibm

1 product

Engineering Lifecycle Optimization Publishing

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ibm Engineering Lifecycle Optimization Publishing	Version 2.0.1

Related CWEs

CWE-434

Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

References (4)

http://www-01.ibm.com/support/docview.wss?uid=swg21988263

Source: psirt@us.ibm.com

PatchVendor Advisory

http://www.securityfocus.com/bid/92334

Source: psirt@us.ibm.com

http://www-01.ibm.com/support/docview.wss?uid=swg21988263

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

http://www.securityfocus.com/bid/92334

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.