IBM UrbanCode Deploy 6.0 and 6.0.1.x before 6.0.1.10, 6.1.1.x before 6.1.1.8, and 6.1.2 writes admin AUTH_TOKEN values to execution logs, which allows remote authenticated users to gain privileges by leveraging the ability to create and execute a process.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Urbancode_deploy | Ibm | 6.0 (including) | 6.0 (including) |
| Urbancode_deploy | Ibm | 6.0.1.0 (including) | 6.0.1.0 (including) |
| Urbancode_deploy | Ibm | 6.0.1.1 (including) | 6.0.1.1 (including) |
| Urbancode_deploy | Ibm | 6.0.1.2 (including) | 6.0.1.2 (including) |
| Urbancode_deploy | Ibm | 6.0.1.3 (including) | 6.0.1.3 (including) |
| Urbancode_deploy | Ibm | 6.0.1.4 (including) | 6.0.1.4 (including) |
| Urbancode_deploy | Ibm | 6.0.1.5 (including) | 6.0.1.5 (including) |
| Urbancode_deploy | Ibm | 6.0.1.6 (including) | 6.0.1.6 (including) |
| Urbancode_deploy | Ibm | 6.0.1.7 (including) | 6.0.1.7 (including) |
| Urbancode_deploy | Ibm | 6.0.1.8 (including) | 6.0.1.8 (including) |
| Urbancode_deploy | Ibm | 6.0.1.9 (including) | 6.0.1.9 (including) |
| Urbancode_deploy | Ibm | 6.1.1.0 (including) | 6.1.1.0 (including) |
| Urbancode_deploy | Ibm | 6.1.1.1 (including) | 6.1.1.1 (including) |
| Urbancode_deploy | Ibm | 6.1.1.2 (including) | 6.1.1.2 (including) |
| Urbancode_deploy | Ibm | 6.1.1.3 (including) | 6.1.1.3 (including) |
| Urbancode_deploy | Ibm | 6.1.1.4 (including) | 6.1.1.4 (including) |
| Urbancode_deploy | Ibm | 6.1.1.5 (including) | 6.1.1.5 (including) |
| Urbancode_deploy | Ibm | 6.1.1.6 (including) | 6.1.1.6 (including) |
| Urbancode_deploy | Ibm | 6.1.1.7 (including) | 6.1.1.7 (including) |
| Urbancode_deploy | Ibm | 6.1.2 (including) | 6.1.2 (including) |