#VU95170 Improper Restriction of Rendered UI Layers or Frames in IBM Sterling B2B Integrator - CVE-2023-42011

Vulnerability identifier: #VU95170

Vulnerability risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2023-42011

CWE-ID: CWE-1021

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
IBM Sterling B2B Integrator
Server applications / Other server solutions

Vendor: IBM Corporation

Description

The vulnerability allows a remote user to modify data on the system.

The vulnerability exists due to IBM Sterling B2B Integrator Standard Edition does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain. A remote user can trigger the vulnerability and modify data on the system.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

IBM Sterling B2B Integrator: 6.1, 6.2

---

External links
https://www.ibm.com/support/pages/node/7158657
https://exchange.xforce.ibmcloud.com/vulnerabilities/265508

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.