PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-0320 IBM CVE debrief

CVE-2016-0320 affects IBM UrbanCode Deploy and describes a REST authorization weakness that could allow an authenticated user to modify UCD objects. NVD and the vendor reference indicate the issue can alter the behavior of legitimately triggered processes, making it a meaningful integrity concern for deployment and release automation environments. NVD scores the issue CVSS 3.0 4.3 (Medium).

Vendor
IBM
Product
Urbancode Deploy
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

IBM UrbanCode Deploy administrators, release engineering and DevOps teams, security teams that manage CI/CD tooling, and anyone responsible for delegated access to UCD object editing or REST API usage.

Technical summary

According to the NVD description, multiple REST endpoints in IBM UrbanCode Deploy did not properly authorize users editing UCD objects. The result is an authenticated authorization bypass at the object-editing layer: a user with valid access could modify UCD objects they should not be able to change, which could then affect the behavior of legitimate processes that depend on those objects. NVD maps the issue to CWE-284 (Improper Access Control) and lists the vector as CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Defensive priority

Medium

Recommended defensive actions

  • Review the IBM vendor advisory and apply the referenced patch or update for affected UrbanCode Deploy deployments.
  • Inventory UrbanCode Deploy instances and compare them against the vulnerable 6.x releases listed by NVD.
  • Restrict who can edit UCD objects and verify that REST/API permissions align with least-privilege expectations.
  • Audit for unexpected changes to deployment objects, workflows, and related configuration data.
  • Validate affected processes after remediation to confirm legitimate triggers still behave as expected.

Evidence notes

All core claims are taken from the supplied NVD record and its cited vendor references. The NVD description states that authenticated users could modify UCD objects because multiple REST endpoints did not properly authorize editing users. The NVD record also lists CWE-284 and provides a Medium CVSS 3.0 vector. The supplied NVD metadata enumerates multiple vulnerable IBM UrbanCode Deploy 6.0, 6.1, and 6.2 releases, and the IBM advisory is referenced by NVD as the patch/vendor source.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-0320 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-0320

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-0320 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-0320

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.