Description

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticated remote attacker could exploit this vulnerability to write arbitrary files to the system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-25T15:17:56.273Z",
  "pubdate": "2026-09-25T15:17:56.273Z",
  "executiveSummary": "IBM Guardium Data Protection 12.2 contains a path traversal vulnerability within the Universal Connector Oracle Wallet upload component. This flaw allows an authenticated remote attacker to execute arbitrary file write operations on the underlying filesystem.\nThe vulnerability originates from improper validation of user-supplied input when processing file uploads. By manipulating path traversal sequences, an attacker can bypass directory restrictions to store malicious files in unauthorized locations.\nThe impact of this vulnerability is severe, as it grants attackers the ability to overwrite critical system configuration files, inject malicious scripts, or modify application binaries. Successful exploitation could lead to full system compromise, remote code execution, or persistent backdoors.\nExploitation requires the attacker to be authenticated to the IBM Guardium interface. The risk is significant due to the potential for complete loss of confidentiality, integrity, and availability of the database security platform.",
  "technicalDetails": "The vulnerability resides in the Universal Connector component of IBM Guardium Data Protection 12.2, specifically within the logic responsible for processing and storing Oracle Wallet files uploaded by users. The system fails to properly sanitize or validate the file path parameters associated with the upload request.\nThe root cause is a lack of path normalization and input filtering on the server-side component. When a user initiates an upload request, the application does not sufficiently verify that the intended destination directory is confined to the expected storage location for Oracle Wallet artifacts. An attacker can supply a crafted filename containing dot-dot-slash (../) sequences to escape the designated directory and traverse to arbitrary locations on the filesystem.\nThe attack flow commences with the attacker establishing an authenticated session with the IBM Guardium management interface. The attacker targets the Universal Connector configuration module where the file upload function for Oracle Wallet is exposed. During the transmission of the multipart/form-data upload request, the attacker modifies the file path or filename metadata to include directory traversal sequences.\nUpon receiving the malicious payload, the vulnerable component processes the file path without restrictive checks. The application's underlying process, running with sufficient privileges, performs a write operation to the resolved destination path, which now points outside the intended safe directory. By carefully choosing the traversal path, an attacker can target sensitive system directories, configuration files, or executable paths.\nThe post-exploitation impact includes the ability to perform arbitrary file overwriting. If an attacker replaces an application configuration file or a binary executed by the system, they can redirect execution flow or change system security parameters. This manipulation allows for the potential execution of malicious code or the introduction of persistent access mechanisms, effectively bypassing the intended security controls of the IBM Guardium appliance."
}