PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-0320 IBM CVE debrief

CVE-2016-0320 affects IBM UrbanCode Deploy and describes a REST authorization weakness that could allow an authenticated user to modify UCD objects. NVD and the vendor reference indicate the issue can alter the behavior of legitimately triggered processes, making it a meaningful integrity concern for deployment and release automation environments. NVD scores the issue CVSS 3.0 4.3 (Medium).

Vendor
IBM
Product
CVE-2016-0320
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

IBM UrbanCode Deploy administrators, release engineering and DevOps teams, security teams that manage CI/CD tooling, and anyone responsible for delegated access to UCD object editing or REST API usage.

Technical summary

According to the NVD description, multiple REST endpoints in IBM UrbanCode Deploy did not properly authorize users editing UCD objects. The result is an authenticated authorization bypass at the object-editing layer: a user with valid access could modify UCD objects they should not be able to change, which could then affect the behavior of legitimate processes that depend on those objects. NVD maps the issue to CWE-284 (Improper Access Control) and lists the vector as CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Defensive priority

Medium

Recommended defensive actions

  • Review the IBM vendor advisory and apply the referenced patch or update for affected UrbanCode Deploy deployments.
  • Inventory UrbanCode Deploy instances and compare them against the vulnerable 6.x releases listed by NVD.
  • Restrict who can edit UCD objects and verify that REST/API permissions align with least-privilege expectations.
  • Audit for unexpected changes to deployment objects, workflows, and related configuration data.
  • Validate affected processes after remediation to confirm legitimate triggers still behave as expected.

Evidence notes

All core claims are taken from the supplied NVD record and its cited vendor references. The NVD description states that authenticated users could modify UCD objects because multiple REST endpoints did not properly authorize editing users. The NVD record also lists CWE-284 and provides a Medium CVSS 3.0 vector. The supplied NVD metadata enumerates multiple vulnerable IBM UrbanCode Deploy 6.0, 6.1, and 6.2 releases, and the IBM advisory is referenced by NVD as the patch/vendor source.

Official resources

Publicly disclosed in the NVD/CVE record on 2017-02-01. The later 2026-05-13 modified date reflects record maintenance, not the original vulnerability date.