Medium · 6.8 CVE-2022-33165 EUVD-2022-36210GHSA-2q58-xp4p-xpqc

IBM Security Directory Server information disclosure

Published Oct 14, 2023 · Updated Sep 17, 2024 · Assigned by ibm

Vendor: IBM Product: Security Directory Server

Description

IBM Security Directory Server 6.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM X-Force ID: 228582.

Affected products

Vendor	Product	Affected	Fixed
IBM	Security Directory Server	6.4.0	—

Advisories 1

WID-SEC-2024-3571 HCL Commerce: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen BSI CERT-Bund (WID) · Dec 1, 2024

References

https://www.ibm.com/support/pages/node/7047116 vendor-advisory
https://www.ibm.com/support/pages/node/7047428 vendor-advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/228582 vdb-entry