VIR Vulnerability Intelligence Relay

CVE-2016-8938

critical
Published 2017-02-01 · Modified 2026-05-13
CVSS v3
10.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v2
10.0
VIR risk
10.0

Description

IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server. This code could be executed on the UCD agent machines that host customer's production applications.

Predictions

Exploit likelihood
98%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: psirt@us.ibm.com — http://www.ibm.com/support/docview.wss?uid=swg2C1000237

Application impact
VendorProductVersionsFixed
ibmurbancode_deploy6.0
ibmurbancode_deploy6.0.1
ibmurbancode_deploy6.0.1.1
ibmurbancode_deploy6.0.1.2
ibmurbancode_deploy6.0.1.3
ibmurbancode_deploy6.0.1.4
ibmurbancode_deploy6.0.1.5
ibmurbancode_deploy6.0.1.6
ibmurbancode_deploy6.0.1.7
ibmurbancode_deploy6.0.1.8
ibmurbancode_deploy6.0.1.9
ibmurbancode_deploy6.0.1.10
ibmurbancode_deploy6.0.1.11
ibmurbancode_deploy6.0.1.12
ibmurbancode_deploy6.0.1.13
ibmurbancode_deploy6.0.1.14
ibmurbancode_deploy6.1
ibmurbancode_deploy6.1.0.1
ibmurbancode_deploy6.1.0.2
ibmurbancode_deploy6.1.0.3
ibmurbancode_deploy6.1.0.4
ibmurbancode_deploy6.1.1
ibmurbancode_deploy6.1.1.1
ibmurbancode_deploy6.1.1.2
ibmurbancode_deploy6.1.1.3
ibmurbancode_deploy6.1.1.4
ibmurbancode_deploy6.1.1.5
ibmurbancode_deploy6.1.1.6
ibmurbancode_deploy6.1.1.7
ibmurbancode_deploy6.1.1.8
ibmurbancode_deploy6.1.2
ibmurbancode_deploy6.1.3
ibmurbancode_deploy6.1.3.1
ibmurbancode_deploy6.1.3.2
ibmurbancode_deploy6.1.3.3
ibmurbancode_deploy6.2.0.0
ibmurbancode_deploy6.2.0.1
ibmurbancode_deploy6.2.0.2
ibmurbancode_deploy6.2.1
ibmurbancode_deploy6.2.1.1
ibmurbancode_deploy6.2.2
ibmurbancode_deploy6.2.2.1

References

CWEs

CWE-284

Verify integrity in audit chain (admin only). AS-IS.