PT-2023-21383 · Ibm · Ibm Informix Jdbc Driver

Xu Yuanzhen · Publicado 2023-06-28 · Atualizado 2023-07-06 · CVE-2023-27866

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Informix JDBC Driver versions 4.10 and 4.50

Description The issue allows for remote code execution via JNDI injection when the driver code or the application using the driver does not verify the supplied LDAP URL in the Connect String.

Recommendations For IBM Informix JDBC Driver versions 4.10 and 4.50, consider verifying the supplied LDAP URL in the Connect String to prevent JNDI injection attacks. As a temporary workaround, consider restricting the use of the Connect String or the LDAP URL until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2023-27866

Produtos afetados

Ibm Informix Jdbc Driver

Referências · 5

• https://t.me/cibsecurity/65634 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-27866 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/249511 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-27866 · Aviso do Fabricante
• https://ibm.com/support/pages/node/7007615 · Aviso do Fabricante