PT-2023-8756 · Ibm · Ibm Security Guardium

Cru3Ll0 + 1 · Published 2023-11-27 · Updated 2023-12-04 · CVE-2023-42004

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Security Guardium versions 11.3 through 11.5

Description The issue is related to improper validation of csv file contents, which could allow a remote attacker to execute malicious commands. This is due to the lack of neutralization of elements in the CSV file.

Recommendations For versions 11.3 through 11.5, consider disabling the import of CSV files until a patch is available to prevent exploitation. Restrict access to the functionality that handles CSV file contents to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

BDU:2024-01823

CVE-2023-42004

Affected Products

Ibm Security Guardium

References · 8

• https://bdu.fstec.ru/vul/2024-01823 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-42004 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/265262 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-42004 · Vendor Advisory
• https://ibm.com/support/pages/node/7069241 · Vendor Advisory
• https://t.me/cvenotify/61323 · Telegram Post
• https://t.me/cvenotify/62177 · Telegram Post
• https://vuldb.com/?id.246300 · Note