CVE-2019-4071

Published: May 9, 2019Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

IBM Tivoli Storage Productivity Center (IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17) could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 157063.

Affected (3)

Products: Ibm: Spectrum Control, Tivoli Storage Productivity Center

2 products

Spectrum Control

Tivoli Storage Productivity Center

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Ibm Spectrum Control	From 5.2.8 to 5.2.17.2
Ibm Spectrum Control	From 5.3.0 to 5.3.1
Ibm Tivoli Storage Productivity Center	From 5.2.0 to 5.2.7.1

Related CWEs

Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

References (4)

http://www.ibm.com/support/docview.wss?uid=ibm10872900

Source: psirt@us.ibm.com

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/157063

Source: psirt@us.ibm.com

VDB EntryVendor Advisory

http://www.ibm.com/support/docview.wss?uid=ibm10872900

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://exchange.xforce.ibmcloud.com/vulnerabilities/157063

Source: af854a3a-2127-422b-91ae-364da2661108

VDB EntryVendor Advisory

Timeline

No history available yet.