PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-6124 IBM CVE debrief

CVE-2016-6124 is a high-severity IBM Kenexa LMS on Cloud vulnerability involving arbitrary file upload. According to the NVD record, a remote attacker with low privileges could upload arbitrary files and potentially execute code on the vulnerable server. Affected versions listed by NVD include 13.1, 13.2, 13.2.2, 13.2.3, and 13.2.4.

Vendor
IBM
Product
Kenexa Lms On Cloud
CVSS
HIGH 8.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-01
Original CVE updated
2026-05-13
Advisory published
2017-02-01
Advisory updated
2026-05-13

Who should care

IBM Kenexa LMS on Cloud administrators, application owners, and security teams responsible for internet-facing or user-upload-enabled deployments should treat this as a priority review item.

Technical summary

The NVD entry maps this issue to CWE-434 (Unrestricted Upload of File with Dangerous Type) and gives a CVSS v3.0 vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The core risk is that a remote attacker can submit arbitrary files through the vulnerable upload path and leverage that to execute code on the server.

Defensive priority

High. The issue is network-exploitable, requires only low privileges, and carries a high CVSS score of 8.8 with potential impact to confidentiality, integrity, and availability.

Recommended defensive actions

  • Review the IBM PSIRT advisory referenced by NVD for remediation guidance.
  • Verify whether any IBM Kenexa LMS on Cloud instances are running affected versions listed by NVD.
  • Restrict or disable file upload functionality where possible until remediation is confirmed.
  • Monitor upload handling paths for unexpected file types, filenames, or execution behavior.
  • Apply IBM-provided fixes or vendor guidance as soon as it is available for the affected deployment.

Evidence notes

The debrief is based on the supplied NVD record published at 2017-02-01T20:59:02.537Z and modified at 2026-05-13T00:24:29.033Z. The NVD data identifies IBM Kenexa LMS on Cloud as affected, lists vulnerable versions 13.1, 13.2, 13.2.2, 13.2.3, and 13.2.4, assigns CVSS v3.0 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and maps the weakness to CWE-434. Vendor and third-party advisory references are included in the source corpus, but their contents were not expanded here.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-6124 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-6124

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-6124 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-6124

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.