Improper access control in Platform Navigator and Automation Assets in IBM Cloud Pak for Integration

1) Improper access control

EUVDB-ID: #VU74478

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-28154

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions on cross-realm objects in ImportParserPlugin.js. A remote attacker who controls a property of an untrusted object can obtain access to the real global object.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Automation Assets in IBM Cloud Pak for Integration (CP4I): before 2022.2.1-7

Platform Navigator in IBM Cloud Pak for Integration (CP4I): before 2022.4.1-3

External links

http://www.ibm.com/support/pages/node/6982851

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.