IBM Operations Dashboard update for Go

1) Code Injection

EUVDB-ID: #VU80571

Risk: Medium

CVSSv4.0: 4.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2023-39320

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation within the go.mod toolchain directive. A remote attacker can execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Operations Dashboard: 2021.1.1 - 2022.2.1-15-lts

CPE2.3

• cpe:2.3:a:ibm_corporation:operations_dashboard:2021.1.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:operations_dashboard:2021.2.1:*:*:*:*:*:*:*
• cpe:2.3:a:ibm_corporation:operations_dashboard:2021.3.1:*:*:*:*:*:*:*

External links

https://www.ibm.com/support/pages/node/7076269

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.