CVE-2014-6158 json
Multiple directory traversal vulnerabilities in the file-upload feature in IBM PureApplication System 1.0 before 1.0.0.4 iFix 10, 1.1 befor…
published 11y ago modified 4mo ago also EUVD-2014-6044
- cvss
- 9.0
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 3.7%
- EPSS 3.7% chance of exploitation in 30 days, percentile 89%
- public exploits
- 0
- none known
Summary
Multiple directory traversal vulnerabilities in the file-upload feature in IBM PureApplication System 1.0 before 1.0.0.4 iFix 10, 1.1 before 1.1.0.5, and 2.0 before 2.0.0.1 and Workload Deployer 3.1.0.7 before IF5 allow remote authenticated users to execute arbitrary code via a (1) Script Package, (2) Add-On, or (3) Emergency Fixes component.
Patch / fix
Is CVE-2014-6158 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerExploit prediction
3.67% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.0 | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
www-01.ibm.com
/support/docview.wss?uid=swg21693292
patch, vendor-advisory
-
www-01.ibm.com
/support/docview.wss?uid=swg21693440
patch, vendor-advisory
-
secunia.com
/advisories/62032
third-party-advisory
-
secunia.com
/advisories/61956
third-party-advisory
-
exchange.xforce.ibmcloud.com
/vulnerabilities/97707
vdb-entry
Sources
- CVE List CVE-2014-6158
- NVD CVE-2014-6158
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.