CVE-2026-49483: codefori vscode-ibmi, лоша конфигурация

Описание

Оригинално описание

Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1.

Засегнати продукти

• codefori vscode-ibmi: < 3.0.1

Вид слабост

• CWE-732 Incorrect Permission Assignment for Critical Resource
• CWE-345 Недостатъчна проверка на автентичността на данните

История

Други уязвимости в codefori vscode-ibmi

• 5.1CVE-2026-49484

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-49483
• https://nvd.nist.gov/vuln/detail/CVE-2026-49483
• https://github.com/codefori/vscode-ibmi/security/advisories/GHSA-rmqv-7c5v-wvjc
• https://github.com/codefori/vscode-ibmi/commit/6a13990a0f6c2fb4cf71ba8fbde1cef32c808b1e