SB2023122252 - Multiple vulnerabilities in IBM Automation Decision Services
Published: December 22, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 15 secuirty vulnerabilities.
1) Incorrect default permissions (CVE-ID: CVE-2023-43497)
The vulnerability allows a local user to compromise the target system.
The vulnerability exists due to the affected plugin creates the temporary file in the system temporary directory with the default permissions for newly created files within the Stapler web framework. A local user can read and write the file before it is used.
2) Resource exhaustion (CVE-ID: CVE-2021-33503)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation in urllib3 when processing URL with multiple "@" characters in the authority component. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.
3) Security features bypass (CVE-ID: CVE-2023-4853)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to implemented HTTP security policies do not correctly sanitize certain character permutations, which may result in incorrect evaluation of permissions. A remote attacker can bypass the security policy altogether and gain unauthorized access to endpoints or perform a denial of service (DoS) attack.
4) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2023-5072)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to allocation of resources without limits or throttling. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
5) Stored cross-site scripting (CVE-ID: CVE-2023-39151)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to the affected plugin does not sanitize or properly encode URLs of the hyperlinks in build logs. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
6) Input validation error (CVE-ID: CVE-2023-36479)
The vulnerability allows a remote user to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input in org.eclipse.jetty.servlets.CGI Servlet when quoting a command before its execution. A remote user can force the application to execute arbitrary file on the server and potentially compromise the system.
7) Incorrect default permissions (CVE-ID: CVE-2023-43498)
The vulnerability allows a local user to compromise the target system.
The vulnerability exists due to the affected plugin creates the temporary file in the system temporary directory with the default permissions for newly created files within the Jenkins API "MultipartFormDataParser". A local user can read and write the file before it is used.
8) Incorrect default permissions (CVE-ID: CVE-2023-43496)
The vulnerability allows a local user to execute arbitrary code on the system.
The vulnerability exists due to the affected plugin creates the temporary file in the system temporary directory with the default permissions for newly created files. A local user can view contents of files and directories and execute arbitrary code on the target system.
9) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2023-46233)
The vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to usage of a weak PBKDF2 algorithm. A remote attacker can gain access to sensitive information.
10) Stored cross-site scripting (CVE-ID: CVE-2023-43495)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in the "caption" constructor parameter of ExpandableDetailsNote. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
11) Information disclosure (CVE-ID: CVE-2023-43494)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the affected application does not exclude sensitive build variables from this search. A remote user can gain unauthorized access to sensitive information on the system.
12) Improper Authorization (CVE-ID: CVE-2023-41900)
The vulnerability allows a remote user to bypass implemented security restrictions.
The vulnerability exists due to an error in the revocation process. If a Jetty OpenIdAuthenticator uses the optional nested LoginService, and that LoginService decides to revoke an already authenticated user, then the current request will still treat the user as authenticated.
13) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2023-40167)
The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.
The vulnerability exists due to improper validation of HTTP requests when handling the "+" character passed via the HTTP/1 header field. A remote attacker can send a specially crafted HTTP request to the server and smuggle arbitrary HTTP headers.
Successful exploitation of vulnerability may allow an attacker to poison HTTP cache and perform phishing attacks.
14) Incorrect authorization (CVE-ID: CVE-2023-34035)
The vulnerability allows a remote attacker to bypass authorization process.
The vulnerability exists due to authorization rule misconfiguration if the application uses requestMatchers(String) or requestMatchers(HttpMethod, String) and multiple servlets, one of them being Spring MVC’s DispatcherServlet. A remote attacker can bypass authorization rules and gain unauthorized access to the application.
15) Security features bypass (CVE-ID: CVE-2023-34034)
The vulnerability allows a remote attacker to bypass security restrictions.
The vulnerability exists due to the usage of "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Spring WebFlux. A remote unauthenticated attacker can trigger the vulnerability to bypass security restrictions.
Remediation
Install update from vendor's website.