SB2021122234 - Improper neutralization of null byte or NUL Character in IBM Cloud Automation Manager

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2021122234

SB2021122234 - Improper neutralization of null byte or NUL Character in IBM Cloud Automation Manager

Published: December 22, 2021 Updated: May 16, 2023

Security Bulletin ID SB2021122234
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Improper Neutralization of Null Byte or NUL Character (CVE-ID: CVE-2020-7928)

CWE-ID: CWE-158 - Improper Neutralization of Null Byte or NUL Character

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to gain access to sensitive information on the system.

The vulnerability exists due to the affected software does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component. A remote authenticated attacker can trigger a read overrun and access arbitrary memory by issuing specially crafted queries.


Remediation

Install update from vendor's website.

References