Multiple Vulnerabilities in IBM Data Risk Manager

The way IBM handles this is pretty bad. No company, especially the ones selling a security product, should ignore security researchers reports and feedbacks

Also the bugs described in article are quite surprising since for a IBM-sized company, you expect them to have solid authentication/authorization framework which they use for all their products. Is this a acquired product? Authentication mechanism is very unusual. Why would anyone save a session id coming from the user? This is more than trusting user input, I think.

Also ../../etc/passwd attack is a kind of vulnerability that almost every automated vulnerabilty scanner scans.

Most people assume that authenticated pages do not need that much security precautions however as articles shows, when combined with authentication bypass vulnerabilities, you basically give keys of your systems to the attacker.

According to IBM this is not even an active product [1]. Although after some reading it does appear that if a client was still using this solution and was paying for extended support that IBM would take care of them.

I wonder if the security researcher knows if this is a COTS product. I could not find it to download, isn't generally available, and appears to be deprecated by IBMs more cloud centric security solutions

[1]https://www.ibm.com/support/lifecycle/#/details?q45=I355654S...

This appears to be IBM's response.

https://www.ibm.com/support/pages/ibm-data-risk-manager-vuln...

The thing about enterprise services is that they don't operate in the same environment as ones on the open internet. So while these vulnerabilities look bad on their own, they aren't that bad when you stack the enterprise's other security services and processes on top.