CVE-2020-5001

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager versions 3.2.0 through 3.2.7

Description The issue allows a remote attacker to traverse directories on the system by sending a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.

Recommendations For versions 3.2.0 through 3.2.7, consider restricting access to sensitive files and directories to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using URL requests that contain "dot dot" sequences (/../) in the affected API endpoint.