SB2023091208 - Multiple vulnerabilities in IBM App Connect Enterprise
Published: September 12, 2023 Updated: October 25, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Prototype pollution (CVE-ID: CVE-2023-36665)
The vulnerability allows a remote attacker to execute arbitrary JavaScript code.
The vulnerability exists due to improper input validation. A remote attacker can pollute the prototype of Object.prototype by adding and overwriting its data and functions.
2) Security features bypass (CVE-ID: CVE-2023-37903)
The vulnerability allows an attacker to bypass implemented security restrictions.
The vulnerability exists due to unspecified error. An attacker with code execution primitive inside the context of vm2 sandbox can use the Node.js custom inspect function to escape the sandbox and run arbitrary code.
3) Security features bypass (CVE-ID: CVE-2023-37466)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper validation of user-supplied input within the Promise handler. A remote attacker can pass specially crafted data to the application, bypass sanitization with `@@species` accessor property to escape the sandbox and run arbitrary code.
4) Inefficient regular expression complexity (CVE-ID: CVE-2023-26115)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient input validation when processing untrusted input with a regular expressions. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.
Remediation
Install update from vendor's website.