CVE-2020-4534: 
IBM WebSphere App Server vulnerability analysis and mitigation

IBM WebSphere Application Server versions 7.0, 8.0, 8.5, and 9.0 were found to contain a vulnerability that could allow a local authenticated attacker to gain elevated privileges on the system. The vulnerability (CVE-2020-4534) was disclosed on July 30, 2020, and is caused by improper handling of UNC paths (IBM Support).

The vulnerability has a CVSS v3 Base Score of 7.8 with the vector (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). The issue stems from improper validation of UNC (Universal Naming Convention) paths in the application server. The vulnerability requires local access and low privileges to exploit, but can result in high impacts to confidentiality, integrity, and availability (IBM Support).

If successfully exploited, this vulnerability allows an attacker to execute arbitrary code with elevated privileges on the affected system. The impact could result in complete compromise of the system's confidentiality, integrity, and availability (IBM Support).

The vulnerability can be exploited by scheduling a task with a specially-crafted UNC path. The attacker needs to be locally authenticated with low privileges to exploit this vulnerability. The attack complexity is considered high, requiring specific conditions to be met for successful exploitation (IBM Support).

IBM has released fixes for all affected versions. For V9.0.0.0 through 9.0.5.4, users can either upgrade to Fix Pack 9.0.5.5 or later, or apply Interim Fix PH26083. For V8.5.0.0 through 8.5.5.17, users should upgrade to Fix Pack 8.5.5.18 or later, or apply Interim Fix PH26083. For V8.0.0.0 through 8.0.0.15 and V7.0.0.0 through 7.0.0.45, users must upgrade to the latest version and apply Interim Fix PH26083. No workarounds are available (IBM Support).

The vulnerability was reported to IBM by Kylinking of NSFOCUS Security Team (IBM Support).