Vulnerability Details : CVE-2009-3518
Potential exploit
Argument injection vulnerability in the iim: URI handler in IBMIM.exe in IBM Installation Manager 1.3.2 and earlier, as used in IBM Rational Robot and Rational Team Concert, allows remote attackers to load arbitrary DLL files via the -vm option, as demonstrated by a reference to a UNC share pathname.
Products affected by CVE-2009-3518
- cpe:2.3:a:ibm:installation_manager:*:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:installation_manager:1.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:installation_manager:1.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:installation_manager:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:ibm:installation_manager:1.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2009-3518
7.86%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 91 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2009-3518
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2009-3518
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
References for CVE-2009-3518
-
http://www.vupen.com/english/advisories/2009/2792
Vendor Advisory
-
http://retrogod.altervista.org/9sg_ibm_uri.html
Exploit
Jump to