SB2023071612 - Multiple vulnerabilities in Axway SecureTransport
Published: July 16, 2023 Updated: May 23, 2024
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2023-28709)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an incomplete fox for #VU72427 (CVE-2023-24998). If non-default HTTP connector settings were used such that the maxParameterCount could be reached using query string parameters and a request was submitted that supplied exactly maxParameterCount parameters in the query string, the limit for uploaded request parts could be bypassed. A remote attacker can initiate a series of uploads and perform a denial of service (DoS) attack.2) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2023-24998)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to Apache Commons FileUpload does not limit the number of request parts. A remote attacker can initiate a series of uploads and perform a denial of service (DoS) attack.
3) Reliance on Reverse DNS Resolution for a Security-Critical Action (CVE-ID: CVE-2020-11971)
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to Apache Camel JMX is vulnerable to DNS rebinding attack. A remote attacker can send specially crafted data to the application and perform spoofing attack.
4) Improper access control (CVE-ID: CVE-2023-28154)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions on cross-realm objects in ImportParserPlugin.js. A remote attacker who controls a property of an untrusted object can obtain access to the real global object.
5) Improper access control (CVE-ID: N/A)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions to the ST Web Client Theme Editor. A remote attacker can bypass implemented security restrictions and gain unauthorized access to the application.
Remediation
Install update from vendor's website.