TI-2023-24200 Aliases CVE-2023-45188 GHSA-83gq-52q2-4f4v

IBM Engineering Lifecycle Optimization Publishing file upload

MEDIUM 43CWE-434Published 2024-06-09 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

IBM Engineering Lifecycle Optimization Publishing 7.0.2 and 7.03 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially crafted request, a remote attacker could exploit this vulnerability to upload a malicious file, which could allow the attacker to execute arbitrary code on the vulnerable system. IBM X-Force ID: 268751.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00651 51st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
IBM	Engineering Lifecycle Optimization Publishing	7.0.2, 7.0.3	—	No fix listed	CNA

Engineering Lifecycle Optimization Publishing VendorIBM Affected 7.0.2, 7.0.3 Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:ibm:engineering_lifecycle_optimization_publishing:7.0.2:::::::*	7.0.2	Vulnerable	IBM
cpe:2.3:a:ibm:engineering_lifecycle_optimization_publishing:7.0.3:::::::*	7.0.3	Vulnerable	IBM
cpe:2.3:o:linux:linux_kernel:-:::::::*	not specified by NVD	Running on	Linux
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:ibm:engineering_lifecycle_optimization_publishing:7.0.2:*:*:*:*:*:*:* Versions 7.0.2 Vulnerable ·IBM
cpe:2.3:a:ibm:engineering_lifecycle_optimization_publishing:7.0.3:*:*:*:*:*:*:* Versions 7.0.3 Vulnerable ·IBM
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Linux
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-45188
2026-10-03 Alias added: GHSA-83gq-52q2-4f4v
2026-10-14 EPSS moved to the 50th–90th percentile

References

Advisory 1

https://www.ibm.com/support/pages/node/7156757

TI-2024-27815 IBM Engineering Lifecycle Optimization - Publishing denial of service CVSS 3.1HIGH 7.5
TI-2024-27816 IBM Engineering Lifecycle Optimization - Publishing SQL injection CVSS 3.1HIGH 7.3
TI-2024-27817 IBM Engineering Lifecycle Optimization - Publishing unhandled SLL exception CVSS 3.1MEDIUM 6.5
TI-2024-27813 IBM Engineering Lifecycle Optimization - Publishing information disclosure CVSS 3.1HIGH 7.5
TI-2021-16441 IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2… CVSS 3.1MEDIUM 6.5
TI-2024-27814 IBM Engineering Lifecycle Optimization - Publishing directory traversal CVSS 3.1MEDIUM 6.5

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences