PT-2023-31405 · Ibm · Ibm Financial Transaction Manager For Swift Services

CVE-2023-49880 · Publicado 2023-12-24 · Atualizado 2024-01-03

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager for SWIFT Services version 3.2.4

Description The Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services assumes the sending address and the message type of FIN messages are immutable. However, an attacker might modify these elements of a business transaction.

Recommendations For IBM Financial Transaction Manager for SWIFT Services version 3.2.4, consider restricting access to the MER facility to minimize the risk of exploitation until a patch is available. As a temporary workaround, avoid using the MER facility for FIN messages that require immutable sending addresses and message types.

Correção

Identificadores relacionados

CVE-2023-49880

Produtos afetados

Ibm Financial Transaction Manager For Swift Services

Referências · 8

• https://t.me/cvenotify/65172 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-49880 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/273183 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-49880 · Nota de Segurança
• https://twitter.com/CVEnew/status/1739112527492264013 · Publicação no Twitter
• https://t.me/cvenotify/66119 · Publicação no Telegram
• https://ibm.com/support/pages/node/7101167 · Aviso do Fabricante
• https://twitter.com/RedPacketSec/status/1739225255686672866 · Publicação no Twitter