CVE-2018-1847

Vulnerability

IBM Financial Transaction Manager (FTM) for Multi-Platform (MP) versions 2.0.0.0 through 2.0.0.5, 2.1.0.0 through 2.1.0.4, 2.1.1.0 through 2.1.1.4, and 3.0.0.0 through 3.0.0.8 are vulnerable to a path traversal attack via the Save/Export function available on search result displays [1]. The vulnerability allows sending a specially-crafted URL request containing "dot dot" sequences (/../) to access files outside the intended directory. Versions 3.2.0 and 3.2.2 are not affected.

Exploitation

Exploitation requires authentication with low privileges (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) [1]. An attacker can send a crafted URL to the vulnerable Save/Export endpoint, using path traversal sequences to read arbitrary files on the system. No user interaction is needed beyond the attacker's own session.

Impact

Successful exploitation allows an attacker to read arbitrary files from the system, leading to information disclosure. The confidentiality impact is low, and there is no impact to integrity or availability [1].

Mitigation

IBM recommends upgrading to the latest version of Financial Transaction Manager and obtaining the latest OAC (Web UI) from Fix Central [1]. For v3.0.0.x, upgrade to v3.0.0.9. The OAC from the latest product versions supports the affected fixpack levels (2.0.0.5, 2.1.0.4, 2.1.1.4, and 3.0.0.9) [1].