CVE-2016-6023

Published: Oct 6, 2016Modified: May 6, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Directory traversal vulnerability in the Configuration Manager in IBM Sterling Secure Proxy (SSP) 3.4.2 before 3.4.2.0 iFix 8 and 3.4.3 before 3.4.3.0 iFix 1 allows remote attackers to read arbitrary files via a crafted URL.

Affected (9)

Products: Ibm: Sterling Secure Proxy

Ibm

1 product

Sterling Secure Proxy

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Ibm Sterling Secure Proxy	Version 3.4.2.0
Ibm Sterling Secure Proxy	Version 3.4.2.0 ifix1
Ibm Sterling Secure Proxy	Version 3.4.2.0 ifix2
Ibm Sterling Secure Proxy	Version 3.4.2.0 ifix3
Ibm Sterling Secure Proxy	Version 3.4.2.0 ifix4
Ibm Sterling Secure Proxy	Version 3.4.2.0 ifix5
Ibm Sterling Secure Proxy	Version 3.4.2.0 ifix6
Ibm Sterling Secure Proxy	Version 3.4.2.0 ifix7
Ibm Sterling Secure Proxy	Version 3.4.3.0

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (4)

http://www-01.ibm.com/support/docview.wss?uid=swg21991278

Source: psirt@us.ibm.com

Vendor Advisory

http://www.securityfocus.com/bid/93347

Source: psirt@us.ibm.com

http://www-01.ibm.com/support/docview.wss?uid=swg21991278

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/93347

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.