IBM SmartCloud Analytics - Log Analysis Privilege Escalation Vulnerability

A vulnerability allowing local, authenticated attackers to bypass client-side security enforcement and manipulate data has been identified in IBM SmartCloud Analytics - Log Analysis versions 1.3.7.0, 1.3.7.1, 1.3.7.2, 1.3.8.0, 1.3.8.1, and 1.3.8.2. This vulnerability arises from a client-side enforcement issue that fails to properly regulate server-side security, potentially leading to unauthorized data manipulation.

Impact

Exploitation of this vulnerability could allow low-privilege users to escalate privileges by changing the passwords of high-privilege accounts, according to IBM.

Remediation

Users can upgrade to IBM Operations Analytics - Log Analysis version 1.3.8.2 Interim Fix 1. For versions prior to 1.3.8.2, upgrade to 1.3.8-TIV-IOALA-FP2 before installing this fix.