PT-2023-6506 · Ibm · Ibm App Connect Enterprise+1

Published 2023-10-14 · Updated 2023-10-19 · CVE-2023-45176

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise versions 11.0.0.1 through 11.0.0.23 IBM App Connect Enterprise versions 12.0.1.0 through 12.0.10.0 IBM Integration Bus versions 10.1 through 10.1.0.1

Description The issue is related to insufficient input validation in the integration software, which can be exploited to cause a denial of service for integration nodes on Windows.

Recommendations For IBM App Connect Enterprise versions 11.0.0.1 through 11.0.0.23, update to a version that includes the fix for this issue. For IBM App Connect Enterprise versions 12.0.1.0 through 12.0.10.0, update to a version that includes the fix for this issue. For IBM Integration Bus versions 10.1 through 10.1.0.1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to integration nodes on Windows to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-07253

CVE-2023-45176

Affected Products

Ibm App Connect Enterprise

Ibm Integration Bus

References · 6

• https://ibm.com/support/pages/node/7051448 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/267998 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07253 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-45176 · Security Note
• https://osv.dev/vulnerability/CVE-2023-45176 · Vendor Advisory
• https://t.me/cvenotify/59494 · Telegram Post