SB2023091427 - Multiple vulnerabilities in IBM App Connect Enterprise Certified Container

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023091427

SB2023091427 - Multiple vulnerabilities in IBM App Connect Enterprise Certified Container

Published: September 14, 2023 Updated: October 25, 2024

Security Bulletin ID SB2023091427
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 50% Medium 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Security features bypass (CVE-ID: CVE-2023-37466)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to improper validation of user-supplied input within the Promise handler. A remote attacker can pass specially crafted data to the application, bypass sanitization with `@@species` accessor property to escape the sandbox and run arbitrary code.


2) Security features bypass (CVE-ID: CVE-2023-37903)

The vulnerability allows an attacker to bypass implemented security restrictions.

The vulnerability exists due to unspecified error. An attacker with code execution primitive inside the context of vm2 sandbox can use the Node.js custom inspect function to escape the sandbox and run arbitrary code.


Remediation

Install update from vendor's website.

References