PT-2021-22326 · Ibm · Ibm Db2

Max Nielsen + 1 · Published 2021-12-09 · Updated 2022-01-21 · CVE-2021-38931

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) versions 11.1 through 11.5

Description The issue is related to an information disclosure where a connected user has indirect read access to a table they are not authorized to select from.

Recommendations For versions 11.1 through 11.5, update to a version that includes the fix for this issue to prevent unauthorized access to tables. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2021-38931

Affected Products

Ibm Db2

References · 7

• https://osv.dev/vulnerability/CVE-2021-38931 · Vendor Advisory
• https://ibm.com/support/pages/node/6523810 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38931 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/210418 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20220114-0001 · Note
• https://t.me/cibsecurity/33714 · Telegram Post
• https://t.me/cvenotify/25483 · Telegram Post