SB2023081514 - Multiple vulnerabilities in IBM Voice Gateway

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023081514

SB2023081514 - Multiple vulnerabilities in IBM Voice Gateway

Published: August 15, 2023

Security Bulletin ID SB2023081514
Severity
Critical
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Critical 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Prototype pollution (CVE-ID: CVE-2023-36665)

The vulnerability allows a remote attacker to execute arbitrary JavaScript code.

The vulnerability exists due to improper input validation. A remote attacker can pollute the prototype of Object.prototype by adding and overwriting its data and functions.


2) Incorrect Regular Expression (CVE-ID: CVE-2022-25883)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expressions. A remote attacker can pass specially crafted data to the application via the new Range function and perform regular expression denial of service (ReDos) attack.


Remediation

Install update from vendor's website.

References