SB2023012384 - Multiple vulnerabilities in IBM Sterling B2B Integrator
Published: January 23, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Improper access control (CVE-ID: CVE-2019-20330)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions related to net.sf.ehcache in FasterXML jackson-databind. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.
2) Deserialization of Untrusted Data (CVE-ID: CVE-2019-12384)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to software allows the logback-core class to process polymorphic deserialization. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
3) XXE attack (CVE-ID: CVE-2018-14720)
The disclosed vulnerability allows a remote attacker to perform XXE attacks.
The vulnerability exists due to fail to block unspecified Java Development Kit (JDK) classes from polymorphic deserialization. A remote attacker can send a specially crafted request that submits malicious input, conduct an XXE attack to access sensitive information, bypass security restrictions, or cause a denial of service (DoS) condition on the targeted system.
4) Code Injection (CVE-ID: CVE-2020-8840)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to absence of xbean-reflect/JNDI gadget blocking. A remote attacker can pass specially crafted input to the application and execute arbitrary Java code on the system, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
5) Input validation error (CVE-ID: CVE-2018-19361)
The disclosed vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code.
The vulnerability exists due to fail to block the openjpa class from polymorphic deserialization. A remote attacker can send a specially crafted request that submits malicious input to perform unauthorized actions on the system, which could allow the attacker to execute arbitrary code or cause a denial of service (DoS) condition.
Remediation
Install update from vendor's website.