Skip to main content

Engineering Lifecycle Optimization Publishing CVE-2016-2914

MEDIUM
Unrestricted Upload of File with Dangerous Type (CWE-434)
2016-08-08 psirt@us.ibm.com
IBM RCE File Upload Engineering Lifecycle Optimization Publishing
5.4
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
5.4 MEDIUM
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low

Lifecycle Timeline

1
CVE Published
Aug 08, 2016 - 01:59 cve.org
MEDIUM 5.4

DescriptionCVE.org

Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows remote authenticated users to execute arbitrary code by specifying an unexpected file extension.

AnalysisAI

Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows remote authenticated users to execute arbitrary code by. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows remote authenticated users to execute arbitrary code by specifying an unexpected file extension. Affected products include: Ibm Engineering Lifecycle Optimization - Publishing.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.

More in Engineering Lifecycle Optimization Publishing

View all
CVE-2021-20371 MEDIUM
6.5 Jun 02

IBM Jazz Foundation and IBM Engineering products could allow a remote attacker to obtain sensitive information when an e
CVE-2016-2912 MEDIUM
5.4 Aug 08

Cross-site scripting (XSS) vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 bef
CVE-2021-29670 MEDIUM
5.4 Jun 02

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4
CVE-2021-29668 MEDIUM
5.4 Jun 02

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4
CVE-2021-20348 MEDIUM
5.4 Jun 02

IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). Rated medium seve
CVE-2021-20347 MEDIUM
5.4 Jun 02

IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). Rated medium seve
CVE-2021-20346 MEDIUM
5.4 Jun 02

IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). Rated medium seve
CVE-2021-20345 MEDIUM
5.4 Jun 02

IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). Rated medium seve
CVE-2021-20343 MEDIUM
5.4 Jun 02

IBM Jazz Foundation and IBM Engineering products are vulnerable to server-side request forgery (SSRF). Rated medium seve
CVE-2021-20338 MEDIUM
5.4 Jun 02

IBM Jazz Foundation and IBM Engineering products are vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4
CVE-2018-1534 MEDIUM
5.4 Oct 12

IBM Rational Publishing Engine 6.0.5 and 6.0.6 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4),

CVE-2018-1533 MEDIUM
5.4 Oct 12

IBM Rational Publishing Engine 6.0.5 and 6.0.6 is vulnerable to cross-site scripting. Rated medium severity (CVSS 5.4),

Same weakness CWE-434 – Unrestricted Upload of File with Dangerous Type

View all
CVE-2016-3088 CRITICAL POC
9.8
CVE-2021-31207 MEDIUM POC
6.6
CVE-2017-12617 HIGH POC
8.1
CVE-2017-11357 CRITICAL POC
9.8
CVE-2017-12615 HIGH POC
8.1
CVE-2024-5084 CRITICAL POC
9.8
CVE-2020-36847 CRITICAL POC
9.8
CVE-2017-6090 HIGH POC
8.8

Same technique RCE

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2016-4117 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8

Share

CVE-2016-2914 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy