## Summary
IBM i 7.6, 7.5, 7.4, and 7.3 are vulnerable in Navigator for i to privilege escalation. An authenticated user could elevate privileges to a root user and execute commands.
## Technical Details
- Vulnerability type: privilege escalation in Navigator for i on IBM i.
- Attack prerequisites: authenticated access to the vulnerable component.
- Impacted capability: elevated privileges enabling command execution as a root user.
- Reported weakness category: CWE-78.
## Affected
- IBM i 7.6
- IBM i 7.5
- IBM i 7.4
- IBM i 7.3
## Impact
- Privilege escalation to root for an authenticated user.
- Command execution with elevated privileges.
- CVSS indicates network reachability (AV:N) with low attack complexity (AC:L) and low required privileges (PR:L).
## Mitigation
1. Apply IBM’s recommended fixes for Navigator for i on the affected IBM i releases:
- IBM i 7.6: PTF SJ10887 (see https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10887)
- IBM i 7.5: PTF SJ10888 (see https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10888)
- IBM i 7.4: PTF SJ10890 (see https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10890)
- IBM i 7.3: PTF SJ10891 (see https://www.ibm.com/mysupport/s/fix-information?legacy=SJ10891)
2. For unsupported IBM i versions, upgrade to a supported fixed release (IBM strongly recommends addressing the vulnerability now).
3. No workarounds/mitigations were provided in the reference.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-78