SB2023103009 - Multiple vulnerabilities in IBM Business Automation Workflow and IBM Case Manager
Published: October 30, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 18 secuirty vulnerabilities.
1) Infinite loop (CVE-ID: CVE-2022-23437)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when parsing XML documents. A remote attacker can supply a specially crafted XML document, consume all available system resources and cause denial of service conditions.
2) Code Injection (CVE-ID: CVE-2022-42890)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to the application allows running Java classes via JavaScript. A remote user can use JavaScript to execute a Java class on the system and obtain its execution results.
Example:
Runtime.getRuntime().exec("xxx");
3) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2022-38398)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input in DefaultExternalResourceSecurity when handling URLs loaded though jar protocol. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
4) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2022-38648)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
5) Code Injection (CVE-ID: CVE-2022-41704)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure processing links to .jar files inside .svg images. A remote attacker can upload a malicious .svg image that contains links to .jar files and execute arbitrary Java code on the system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Code injection example:
<script type="application/java-archive" xlink:href="file.jar"/>
6) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2022-40146)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of URLs in jar files. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
7) Resource exhaustion (CVE-ID: CVE-2021-36374)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing ZIP archives. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
8) Resource exhaustion (CVE-ID: CVE-2021-36373)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing TAR archives. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
9) Out-of-bounds write (CVE-ID: CVE-2022-41854)
The vulnerability allows a remote attacker to perform a denial of service attack.
The vulnerability exists due to a boundary error when parsing untrusted YAML files. A remote attacker can send a specially crafted YAML file, trick the victim into opening it using the affected software, trigger out-of-bounds write and perform a denial of service attack.
10) Path traversal (CVE-ID: CVE-2021-29425)
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error within the FileNameUtils.normalize method when processing directory traversal sequences, such as "//../foo", or "\..foo". A remote attacker can send a specially crafted request and verify files availability in the parent folder.
11) Incorrect default permissions (CVE-ID: CVE-2020-1945)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to Apache Ant is using a default temporary directory identified by the Java system property java.io.tmpdir for several tasks and may thus leak sensitive information. The fixcrlf and replaceregexp tasks also copy files from the temporary directory back into the build tree allowing an attacker to inject modified source files into the build process. A local user with access to the system can view contents of files and directories or modify them.
12) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2020-11988)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of user-supplied input within the XMPParser in Apache XmlGraphics Commons. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
13) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2019-17566)
The disclosed vulnerability allows a remote attacker to perform SSRF attacks.
The vulnerability exists due to insufficient validation of "xlink:href" attributes. A remote attacker can send a specially crafted HTTP request and trick the application to initiate requests to arbitrary systems.
Successful exploitation of this vulnerability may allow a remote attacker gain access to sensitive data, located in the local network or send malicious requests to other servers from the vulnerable system.
14) Infinite loop (CVE-ID: CVE-2018-8036)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to infinite loop when handling malicious input. A remote attacker can supple specially crafted (or fuzzed) file, trigger out of memory exception and cause the service to crash.
15) Deserialization of untrusted data (CVE-ID: CVE-2018-8013)
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists due to insufficient validation of user-supplied data. A remote attacker can supply specially crafted data, trigger a deserialization error in a subclass of 'AbstractDocuent' and access potentially sensitive information.
16) Uncontrolled memory allocation (CVE-ID: CVE-2018-10237)
The vulnerability allows a remote attacker to cause DoS condition on the target system.The weakness exists due to unbounded memory allocation. A remote attacker can cause the service to crash and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.
17) Resource exhaustion (CVE-ID: CVE-2013-4002)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
18) Improper input validation (CVE-ID: CVE-2012-0881)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the UI Infrastructure (Apache Xerces2 Java Parser) component in Oracle Transportation Management. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.