{"timestamp":"2024-08-29T00:00:00+00:00","id":"CVE-2024-27275","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"IBM","product":"i","defaultStatus":"unaffected","cpes":["cpe:2.3:a:ibm:i:7.2:*:*:*:*:*:*:*","cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*","cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*","cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*"],"versions":[{"version":"7.2","status":"affected"},{"version":"7.3","status":"affected"},{"version":"7.4","status":"affected"},{"version":"7.5","status":"affected"}]}]

IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability caused by an insufficient authority requirement. A local user without administrator privilege can configure a physical file trigger to execute with the privileges of a user socially engineered to access the target file. The correction is to require administrator privilege to configure trigger support.  IBM X-Force ID:  285203.

IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability caused by an insufficient authority requirement. A local user without administrator privilege can configure a physical file trigger to execute with the privileges of a user socially engineered to access the target file. The correction is to require administrator privilege to configure trigger support.

CWE-266

CWE-287

https://exchange.xforce.ibmcloud.com/vulnerabilities/285203

https://exchange.xforce.ibmcloud.com/vulnerabilities/285203 Types: VDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/285203

https://www.ibm.com/support/pages/node/7157637

IBM Corporation CWE-287

IBM Corporation CWE-264

NIST AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NIST CWE-287

OR
     *cpe:2.3:a:ibm:i:7.2:*:*:*:*:*:*:*
     *cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*
     *cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*
     *cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*

https://exchange.xforce.ibmcloud.com/vulnerabilities/285203 No Types Assigned

https://exchange.xforce.ibmcloud.com/vulnerabilities/285203 VDB Entry

https://www.ibm.com/support/pages/node/7157637 No Types Assigned

https://www.ibm.com/support/pages/node/7157637 Vendor Advisory

IBM i 7.2, 7.3, 7.4, and 7.5 contains a local privilege escalation vulnerability caused by an insufficient authority requirement. A local user without administrator privilege can configure a physical file trigger to execute with the privileges of a user socially engineered to access the target file. The correction is to require administrator privilege to configure trigger support.  IBM X-Force ID:  285203.

IBM Corporation AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

IBM Corporation CWE-264

IBM Corporation https://exchange.xforce.ibmcloud.com/vulnerabilities/285203 [No types assigned]

IBM Corporation https://www.ibm.com/support/pages/node/7157637 [No types assigned]