Medium · 6.5 CVE-2024-56477 EUVD-2024-53172GHSA-qxcr-5h9v-q8vc

IBM Power Hardware Management Console directory traversal

Published Feb 14, 2025 · Updated Feb 14, 2025 · Assigned by ibm

Vendor: IBM Product: Power Hardware Management Console

Description

IBM Power Hardware Management Console V10.3.1050.0 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Affected products

Vendor	Product	Affected	Fixed
IBM	Power Hardware Management Console	10.3.1050.0	—

Advisories 1

WID-SEC-2025-0364 IBM Power Hardware Management Console: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Feb 12, 2025

References

https://www.ibm.com/support/pages/node/7183224 vendor-advisory