PT-2023-25367 · Ibm · Ibm Informix Jdbc Driver

Publicado 2023-12-20 · Atualizado 2023-12-28 · CVE-2023-35895

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Informix JDBC Driver versions 4.10 through 4.50

Description The issue allows for remote code execution via JNDI injection when an unchecked argument is passed to a certain API.

Recommendations For versions 4.10 through 4.50, consider restricting access to the vulnerable API endpoint until a patch is available. As a temporary workaround, avoid passing unchecked arguments to the affected API.

Correção

OS Command Injection

Special Elements Injection

Enumeração de Fraquezas

CWE-78

CWE-74

Identificadores relacionados

CVE-2023-35895

Produtos afetados

Ibm Informix Jdbc Driver

Referências · 6

• https://osv.dev/vulnerability/CVE-2023-35895 · Aviso do Fabricante
• https://twitter.com/RedPacketSec/status/1737776262490296670 · Publicação no Twitter
• https://ibm.com/support/pages/node/7099762 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1737482302035271810 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-35895 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/259116 · Aviso do Fabricante