## Summary
IBM i 7.6, 7.5, 7.4, and 7.3 are vulnerable in Navigator for i to privilege escalation. An authenticated user could elevate privileges to a root user to execute commands (authenticated privilege escalation to root).
## Technical Details
- Vulnerability class: CWE-269 (Privilege escalation).
- Affected component: Navigator for i on IBM i.
- Attack prerequisites: an attacker must be an authenticated user.
- Impacted capability: the attacker can escalate privileges to a root user and then execute commands.
- No workaround/mitigation is provided in the reference.
## Affected
- IBM i 7.6
- IBM i 7.5
- IBM i 7.4
- IBM i 7.3
## Impact
- Privilege escalation from an authenticated context to root.
- Command execution as a result of the elevated privileges.
- CVSS (from provided data): 8.8 with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
## Mitigation
1. Apply the vendor-provided fixes for Navigator for i on each affected IBM i release:
- 7.6 PTF SJ10887
- 7.5 PTF SJ10888
- 7.4 PTF SJ10890
- 7.3 PTF SJ10891
2. Use the IBM fix information links from the advisory to download and install the corresponding PTF packages.
3. For unsupported IBM i versions, upgrade to a supported and fixed version (IBM recommendation).
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-269