Vscode Ibmi
Monthly
Code for IBM i (vscode-ibmi) releases before 3.0.1 install and later execute IBM i component programs without verifying their integrity, so an authenticated attacker holding a separate local account on the same IBM i system can modify a component such as GETMBRINFO when it was deployed with permissive *PUBLIC authorities, and the altered program then runs in the context of any user who subsequently connects through the extension. The reported CVSS 4.0 score is 8.9, but the independent assessment rates the issue CVSS 3.1 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, reflecting that exploitation requires valid local IBM i credentials, a loosely secured component object, and a victim initiating a connection that triggers the tampered program; no public exploit code or confirmed active exploitation was identified at time of analysis. Version 3.0.1 fixes the flaw, with details in GHSA-rmqv-7c5v-wvjc.
Local information disclosure in Code for IBM i (the codefori/vscode-ibmi Visual Studio Code extension) before 3.0.1 lets other local accounts on the same host read sensitive content written to the shared /tmp directory during Object Browser downloads and the edit-save workflow, because those files are not reliably cleaned up after use. Although the vendor scored it 5.1 on a CVSS:4.0 vector carrying AV:N, exploitation in practice requires an attacker who already holds a separate local account on a shared multi-user machine with a readable /tmp (a common default on many Unix/Linux systems) plus a legitimate developer having performed a download or edit-save in a vulnerable version; single-user workstations and hosts with per-user private temp directories are not affected. Our independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - a low-to-medium risk, confidentiality-only issue - and there is no public exploit identified at time of analysis.
Code for IBM i (vscode-ibmi) releases before 3.0.1 install and later execute IBM i component programs without verifying their integrity, so an authenticated attacker holding a separate local account on the same IBM i system can modify a component such as GETMBRINFO when it was deployed with permissive *PUBLIC authorities, and the altered program then runs in the context of any user who subsequently connects through the extension. The reported CVSS 4.0 score is 8.9, but the independent assessment rates the issue CVSS 3.1 AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, reflecting that exploitation requires valid local IBM i credentials, a loosely secured component object, and a victim initiating a connection that triggers the tampered program; no public exploit code or confirmed active exploitation was identified at time of analysis. Version 3.0.1 fixes the flaw, with details in GHSA-rmqv-7c5v-wvjc.
Local information disclosure in Code for IBM i (the codefori/vscode-ibmi Visual Studio Code extension) before 3.0.1 lets other local accounts on the same host read sensitive content written to the shared /tmp directory during Object Browser downloads and the edit-save workflow, because those files are not reliably cleaned up after use. Although the vendor scored it 5.1 on a CVSS:4.0 vector carrying AV:N, exploitation in practice requires an attacker who already holds a separate local account on a shared multi-user machine with a readable /tmp (a common default on many Unix/Linux systems) plus a legitimate developer having performed a download or edit-save in a vulnerable version; single-user workstations and hosts with per-user private temp directories are not affected. Our independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N - a low-to-medium risk, confidentiality-only issue - and there is no public exploit identified at time of analysis.