PT-2023-8726 · Ibm · Ibm I

Published 2023-05-02 · Updated 2023-05-10 · CVE-2023-23470

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:L/Au:M/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM i versions 7.2 through 7.5

Description The issue is related to improper SQL processing, allowing an authenticated privileged administrator to gain elevated privileges in non-default configurations. By using a specially crafted SQL operation, the administrator could exploit this to perform additional administrator operations. The vulnerability is associated with a lack of protection for the SQL query structure, which could be exploited by a remote attacker to elevate their privileges.

Recommendations For IBM i versions 7.2 through 7.5, consider restricting access to SQL operations until a proper fix is applied, and ensure that all configurations are reviewed to prevent non-default settings from being exploited. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

SQL injection

Weakness Enumeration

CWE-79

CWE-89

Related Identifiers

BDU:2024-01754

CVE-2023-23470

Affected Products

Ibm I

References · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/244510 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-23470 · Vendor Advisory
• https://ibm.com/support/pages/node/6987767 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-23470 · Security Note
• https://bdu.fstec.ru/vul/2024-01754 · Security Note
• https://t.me/cibsecurity/63293 · Telegram Post