CVE-2023-45188 is a medium severity flaw in IBM Engineering Lifecycle Optimization Publishing 7.0.2 and 7.0.3, scored 6.5. The product could allow a remote attacker to upload arbitrary files because file extensions are not validated properly. IBM says 7. Read the IBM bulletin and apply the listed remedy.
What's affected
IBM bulletin node 7156757, first published on 7 June 2024, lists IBM Engineering Lifecycle Optimization Publishing versions 7.0.2 and 7.0.3 as affected. The NVD record for CVE-2023-45188 was published on 2024-06-09.
NVD scores the flaw 6.5 (Medium) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. IBM publishes 6.5 on its bulletin, using CVSS 3.0 notation, so the two sources agree on the score. IBM also tracks it as X-Force ID 268751.
IBM says 7.0.3 is fixed in iFix003 and 7.0.2 is fixed in iFix029, with no other workaround.
The NVD record lists a Linux kernel entry among its CPE data. The IBM bulletin does not say the flaw is in the kernel, so read that as a platform tag.
Weakness class: CWE-434 (unrestricted file upload).
How to check if you're exposed
Read the installed version of IBM Engineering Lifecycle Optimization Publishing from the application, in the About or system information page of the web console, and compare it with 7.0.2 and 7.0.3.
Then check the patch level. The fix is delivered as an interim fix (iFix) on each version, so the iFix number matters as much as the version. Look for iFix003 or later on 7.0.3 and iFix029 or later on 7.0.2.
What to do now
- Find every deployment of IBM Engineering Lifecycle Optimization Publishing 7.0.2 or 7.0.3.
- Install iFix003 or later on 7.0.3 and iFix029 or later on 7.0.2, following the IBM bulletin.
- Restrict network access to the Publishing application to users who need it.
- Review the web server for files that should not be there, in folders where uploads are stored.
- Subscribe to IBM security bulletins for the product so you hear about future fixes.
Why it matters
Unrestricted upload of a dangerous file type, tracked as CWE-434, happens when an application accepts a file and does not check its extension properly. If the server then treats an uploaded file as code, the upload becomes code execution. IBM states that is the outcome it worries about here.
The score matters less than the context. The 6.5 score is moderate, yet the bulletin describes possible code execution on the server, so put it ahead of other mediums in your queue. CVE-2023-45188 is not on the CISA Known Exploited Vulnerabilities list, and none of the pages I read says it has been exploited in the wild. That is a statement about what is recorded, not a reason to delay.
Quick check
What is the fix for CVE-2023-45188?
IBM says to install iFix003 on 7.0.3 or iFix029 on 7.0.2, or later.
Which versions are affected by CVE-2023-45188?
7.0.2 and 7.0.3 of IBM Engineering Lifecycle Optimization Publishing, per the IBM bulletin.
Sources
- Gold entry for CVE-2023-45188
- IBM security bulletin
- IBM X-Force entry 268751 (page did not render when fetched)
Last reviewed: 19 October 2026.
