LiveActive security incident?Get immediate response
CVE Record

CVE-2019-4236: A IBM Spectrum Protect 7.l client backup or archive operation running for an HP-UX VxFS object is silently...

A IBM Spectrum Protect 7.l client backup or archive operation running for an HP-UX VxFS object is silently skipping Access Control List (ACL) entries from backup or archive if there are more than twelve ACL entries associated with the object in total. As a result, it could allow a local attacker to restore or retrieve the object with incorrect ACL entries. IBM X-Force ID: 159418.

MediumCVSS 5.1Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

IBM Spectrum Protect 7.l clients can silently omit ACL entries when backing up or archiving HP-UX VxFS objects with more than twelve total ACL entries. Restores may recreate files with incorrect permissions, creating confidentiality and integrity risk for affected HP-UX environments.

Executive priority

Treat as a targeted operational integrity issue, not a broad internet-facing emergency. Prioritize affected HP-UX backup environments because the failure is silent and can undermine restored file permissions for sensitive data.

Technical view

The flaw is in IBM Spectrum Protect 7.l client backup/archive handling for HP-UX VxFS objects. When an object has over twelve ACL entries, some ACL entries are skipped from backup or archive. A local attacker could restore or retrieve the object with incorrect ACL entries. CVSS 3.0 score is 5.1.

Likely exposure

Exposure appears limited to organizations using IBM Spectrum Protect 7.l clients to back up or archive HP-UX VxFS objects, especially filesystems using extended ACLs with more than twelve entries. Other IBM Spectrum Protect versions, platforms, or filesystems are not identified in the provided sources.

Exploitation context

The CVE is not listed as KEV, and the supplied sources do not report active exploitation. The described attacker is local, with low attack complexity and no user interaction. The main business risk is silent backup integrity failure that may surface only during restore or access review.

Researcher notes

The provided record does not include CWE mapping or specific fixed versions. CVSS indicates local attack vector, low confidentiality and integrity impact, and no availability impact. Avoid assuming affected products beyond IBM Spectrum Protect 7.l client operations on HP-UX VxFS.

Mitigation direction

  • Check IBM advisory guidance for the affected Spectrum Protect 7.l client.
  • Prioritize upgrade or official fix review where HP-UX VxFS backups are in scope.
  • Identify critical VxFS objects with more than twelve ACL entries.
  • Perform controlled restore tests before relying on affected backup sets.
  • Document compensating access reviews for restored high-value objects.

Validation and detection

  • Inventory IBM Spectrum Protect 7.l clients on HP-UX systems.
  • Confirm whether backup jobs include VxFS objects with extended ACLs.
  • Review restore test results for ACL preservation accuracy.
  • Compare source ACLs with restored ACLs for critical objects.
  • Check IBM X-Force ID 159418 for vendor-specific details.
Prepared
Confidence
high
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-4236 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.1 (3.0)
Known Exploited
No
Published

Vector: CVSS:3.0/AV:L/I:L/C:L/S:U/A:N/PR:N/AC:L/UI:N/RC:C/E:U/RL:O

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.1CVSS 3.0MediumCVSS:3.0/AV:L/I:L/C:L/S:U/A:N/PR:N/AC:L/UI:N/RC:C/E:U/RL:O2.52.5Primary CVE score

Vulnerability scoring details

Base CVSS 3.0 score

5.1Medium
CVSS 3.0 vector shape for CVE-2019-4236Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.0/AV:L/I:L/C:L/S:U/A:N/PR:N/AC:L/UI:N/RC:C/E:U/RL:O

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
IBMSpectrum Protect7.lListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.