PT-2024-1064 · Ibm · Ibm Db2

James Curbow · Published 2024-01-07 · Updated 2025-06-11 · CVE-2023-47145

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Db2 for Windows (includes Db2 Connect Server) versions 10.5 through 11.5

Description The issue is related to insufficient access control in IBM DB2 and DB2 Connect Server, which could allow a local user to escalate their privileges to the SYSTEM user using the MSI repair functionality.

Recommendations For versions 10.5, 11.1, and 11.5, consider disabling the MSI repair functionality as a temporary workaround until a patch is available. Restrict access to the SYSTEM user to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

CWE-264

Related Identifiers

BDU:2024-00295

CVE-2023-47145

Affected Products

Ibm Db2

References · 13

• https://osv.dev/vulnerability/CVE-2023-47145 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00295 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-47145 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/270402 · Vendor Advisory
• https://ibm.com/support/pages/node/7105500 · Vendor Advisory
• https://twitter.com/CVEnew/status/1744074525510160816 · Twitter Post
• https://t.me/cvenotify/73276 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1744107951839723751 · Twitter Post
• https://t.me/cvenotify/66538 · Telegram Post
• https://twitter.com/Esparta6108713/status/1744089083834499259 · Twitter Post
• https://security.netapp.com/advisory/ntap-20240307-0003 · Note
• https://t.me/cvenotify/125403 · Telegram Post
• https://twitter.com/vuldb/status/1744261416654405689 · Twitter Post