PT-2025-10118 · Ibm · Ibm Control Center

Published 2025-03-07 · Updated 2025-03-08 · CVE-2023-43052

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Control Center versions 6.2.1 through 6.3.1

Description The issue is caused by improper validation of user-supplied input, allowing an external service interaction attack. A remote attacker could exploit this to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with.

Recommendations For IBM Control Center versions 6.2.1 through 6.3.1, consider restricting the application's ability to perform server-side DNS lookups or HTTP requests to arbitrary domain names as a temporary workaround until a patch is available. Restrict access to external services to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-435

Related Identifiers

CVE-2023-43052

Affected Products

Ibm Control Center

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-43052 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43052 · Vendor Advisory
• https://t.me/cvedetector/19853 · Telegram Post
• https://ibm.com/support/pages/node/7185102 · Patch, Vendor Advisory
• https://twitter.com/CVEnew/status/1898246344692699410 · Twitter Post
• https://t.me/cvetracker/18685 · Telegram Post