PT-2023-28214 · Ibm · Ibm Urbancode Deploy Agent

Published 2023-12-19 · Updated 2023-12-27 · CVE-2023-42012

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM UrbanCode Deploy Agent versions 7.2 through 7.2.3.7 IBM UrbanCode Deploy Agent versions 7.3 through 7.3.2.2

Description The issue concerns an IBM UrbanCode Deploy Agent installed as a Windows service in a non-standard location, which could be subject to a denial of service attack by local accounts.

Recommendations For IBM UrbanCode Deploy Agent versions 7.2 through 7.2.3.7, consider relocating the service to a standard location to minimize the risk of exploitation. For IBM UrbanCode Deploy Agent versions 7.3 through 7.3.2.2, consider relocating the service to a standard location to minimize the risk of exploitation. As a temporary workaround, consider restricting access to the service to prevent local accounts from initiating a denial of service attack.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2023-42012

Affected Products

Ibm Urbancode Deploy Agent

References · 9

• https://osv.dev/vulnerability/CVE-2023-42012 · Vendor Advisory
• https://ibm.com/support/pages/node/7096548 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42012 · Security Note
• https://t.me/cvenotify/64295 · Telegram Post
• https://twitter.com/CVEnew/status/1737275389624594479 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1737285541014434022 · Twitter Post
• https://t.me/cvenotify/65244 · Telegram Post
• https://twitter.com/Esparta6108713/status/1740077253885866085 · Twitter Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/265509 · Note