SB2022070404 - Multiple vulnerabilities in IBM Cloud Pak for Business Automation

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022070404

SB2022070404 - Multiple vulnerabilities in IBM Cloud Pak for Business Automation

Published: July 4, 2022

Security Bulletin ID SB2022070404
Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact

Breakdown by Severity

High 33% Medium 67%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2022-24434)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can send a modified form to server, and crash the nodejs service. An attacker can sent the payload again and again so that the service continuously crashes.


2) Improper Check for Unusual or Exceptional Conditions (CVE-ID: CVE-2022-23712)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper error handling. A remote attacker can send specifically formatted network request to the application and forcibly shut down an Elasticsearch node.


3) Improper Control of Dynamically-Managed Code Resources (CVE-ID: CVE-2022-25878)

The vulnerability allows a remote attacker to modify data on the system.

The vulnerability exists due to Prototype Pollution error in protobufjs. A remote unauthenticated attacker can provide an untrusted user input to the util.setProperty or to the ReflectionObject.setParsedOption functions, and also by parse/load .proto files to modify data on the system.


Remediation

Install update from vendor's website.

References