Multiple vulnerabilities in IBM Spectrum Copy Data Management

1) Improper input validation

EUVDB-ID: #VU78410

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2023-22041

CWE-ID:

Exploit availability:

Description

The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM for JDK. A local non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Copy Data Management: 2.2.0 - 2.2.20.1

Fixed software versions

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_copy_data_management:2.2.20.1:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/7029389

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

2) Improper input validation

EUVDB-ID: #VU78409

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-22043

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the JavaFX component in Oracle Java SE. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Copy Data Management: 2.2.0 - 2.2.20.1

Fixed software versions

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_copy_data_management:2.2.20.1:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/7029389

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

3) Improper input validation

EUVDB-ID: #VU78412

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2023-22044

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM for JDK. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Copy Data Management: 2.2.0 - 2.2.20.1

Fixed software versions

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_copy_data_management:2.2.20.1:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/7029389

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

4) Improper input validation

EUVDB-ID: #VU78416

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2023-22006

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Networking component in Oracle GraalVM for JDK. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Copy Data Management: 2.2.0 - 2.2.20.1

Fixed software versions

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_copy_data_management:2.2.20.1:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/7029389

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

5) Improper input validation

EUVDB-ID: #VU78413

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2023-22045

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM for JDK. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Copy Data Management: 2.2.0 - 2.2.20.1

Fixed software versions

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_copy_data_management:2.2.20.1:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/7029389

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

6) Improper input validation

EUVDB-ID: #VU78415

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2023-22036

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the Utility component in Oracle GraalVM for JDK. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Copy Data Management: 2.2.0 - 2.2.20.1

Fixed software versions

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_copy_data_management:2.2.20.1:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/7029389

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

7) Improper input validation

EUVDB-ID: #VU78414

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2023-22049

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM for JDK. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Copy Data Management: 2.2.0 - 2.2.20.1

Fixed software versions

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_copy_data_management:2.2.20.1:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/7029389

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

8) Untrusted search path

EUVDB-ID: #VU78454

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-38408

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to usage of an insecure search path within the PKCS#11 feature in ssh-agent. A remote attacker can trick the victim into connecting to a malicious SSH server and execute arbitrary code on the system, if an agent is forwarded to an attacker-controlled system.

Note, this vulnerability exists due to incomplete fix for #VU2015 (CVE-2016-10009).

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Copy Data Management: 2.2.0 - 2.2.20.1

Fixed software versions

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_copy_data_management:2.2.20.1:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/7029389

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

9) Improper Certificate Validation

EUVDB-ID: #VU78913

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-29409

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to verifying certificate chains containing large RSA keys is slow. A remote attacker can cause a client/server to expend significant CPU time verifying signatures.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Copy Data Management: 2.2.0 - 2.2.20.1

Fixed software versions

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_copy_data_management:2.2.20.1:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/7029389

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?

10) Improper Neutralization of HTTP Headers for Scripting Syntax

EUVDB-ID: #VU78327

Risk: Medium

CVSSv3.1:

CVE-ID: CVE-2023-29406

CWE-ID:

Exploit availability:

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to improper input validation in HTTP/1 client when handling HTTP Host header. A remote non-authenticated attacker can send a specially crafted HTTP request with a maliciously crafted Host header and inject additional headers or entire requests.

Successful exploitation of the vulnerability may allow an attacker to perform cross-site scripting, cache poisoning or session hijacking attacks.

Mitigation

Install update from vendor's website.

Vulnerable software versions

IBM Spectrum Copy Data Management: 2.2.0 - 2.2.20.1

Fixed software versions

CPE2.3

• cpe:2.3:a:ibm_corporation:ibm_spectrum_copy_data_management:2.2.20.1:*:*:*:*:*:*:*

External links

http://www.ibm.com/support/pages/node/7029389

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?