Multiple vulnerabilities in IBM Rational Build Forge
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 14 |
| CVE-ID | CVE-2023-21939 CVE-2021-2163 CVE-2023-30441 CVE-2023-2597 CVE-2023-21938 CVE-2023-21937 CVE-2023-21968 CVE-2023-21954 CVE-2023-21967 CVE-2023-21930 CVE-2022-40609 CVE-2023-21843 CVE-2023-21830 CVE-2022-21299 |
| CWE-ID | CWE-20 CWE-200 CWE-125 CWE-502 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #1 is available. |
| Vulnerable software |
IBM Rational Build Forge Server applications / Other server solutions |
| Vendor | IBM Corporation |
Security Bulletin
This security bulletin contains information about 14 vulnerabilities.
1) Improper input validation
EUVDB-ID: #VU75264
Risk: Medium
CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C]
CVE-ID: CVE-2023-21939
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: Yes
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Swing component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Rational Build Forge: 8.0.0.0 - 8.0.0.23
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.0:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.1:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.2:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/7063717
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
2) Improper input validation
EUVDB-ID: #VU52449
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2021-2163
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Rational Build Forge: 8.0.0.0 - 8.0.0.23
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.0:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.1:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.2:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/7063717
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Information disclosure
EUVDB-ID: #VU75508
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-30441
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to sensitive information on the system.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Rational Build Forge: 8.0.0.0 - 8.0.0.23
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.0:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.1:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.2:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/7063717
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Out-of-bounds read
EUVDB-ID: #VU76906
Risk: High
CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-2597
CWE-ID:
CWE-125 - Out-of-bounds read
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to in the implementation of the shared cache (which is enabled by default in OpenJ9 builds) the size of a string is not properly checked against the size of the buffer. A remote attacker can create a specially crafted file, trick the victim into opening it, trigger an out-of-bounds read error and read contents of memory on the system.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Rational Build Forge: 8.0.0.0 - 8.0.0.23
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.0:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.1:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.2:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/7063717
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Improper input validation
EUVDB-ID: #VU75265
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-21938
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Rational Build Forge: 8.0.0.0 - 8.0.0.23
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.0:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.1:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.2:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/7063717
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
6) Improper input validation
EUVDB-ID: #VU75267
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-21937
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Networking component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Rational Build Forge: 8.0.0.0 - 8.0.0.23
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.0:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.1:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.2:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/7063717
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
7) Improper input validation
EUVDB-ID: #VU75266
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-21968
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Libraries component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Rational Build Forge: 8.0.0.0 - 8.0.0.23
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.0:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.1:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.2:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/7063717
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
8) Improper input validation
EUVDB-ID: #VU75262
Risk: Medium
CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-21954
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The vulnerability exists due to improper input validation within the Hotspot component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Rational Build Forge: 8.0.0.0 - 8.0.0.23
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.0:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.1:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.2:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/7063717
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
9) Improper input validation
EUVDB-ID: #VU75261
Risk: Medium
CVSSv3.1: 5.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-21967
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the JSSE component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform a denial of service (DoS) attack.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Rational Build Forge: 8.0.0.0 - 8.0.0.23
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.0:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.1:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.2:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/7063717
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
10) Improper input validation
EUVDB-ID: #VU75260
Risk: Medium
CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-21930
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to read and manipulate data.
The vulnerability exists due to improper input validation within the JSSE component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to read and manipulate data.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Rational Build Forge: 8.0.0.0 - 8.0.0.23
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.0:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.1:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.2:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/7063717
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
11) Deserialization of Untrusted Data
EUVDB-ID: #VU78901
Risk: High
CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-40609
CWE-ID:
CWE-502 - Deserialization of Untrusted Data
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to insecure input validation when processing serialized data. A remote attacker can pass specially crafted data to the application and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Rational Build Forge: 8.0.0.0 - 8.0.0.23
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.0:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.1:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.2:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/7063717
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
12) Improper input validation
EUVDB-ID: #VU71289
Risk: Low
CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-21843
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Sound component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Rational Build Forge: 8.0.0.0 - 8.0.0.23
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.0:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.1:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.2:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/7063717
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
13) Improper input validation
EUVDB-ID: #VU71288
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-21830
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to manipulate data.
The vulnerability exists due to improper input validation within the Serialization component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to manipulate data.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Rational Build Forge: 8.0.0.0 - 8.0.0.23
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.0:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.1:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.2:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/7063717
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
14) Improper input validation
EUVDB-ID: #VU59727
Risk: Medium
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2022-21299
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote non-authenticated attacker to perform service disruption.
The vulnerability exists due to improper input validation within the JAXP component in Oracle GraalVM Enterprise Edition. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.
MitigationInstall update from vendor's website.
Vulnerable software versionsIBM Rational Build Forge: 8.0.0.0 - 8.0.0.23
CPE2.3- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.0:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.1:*:*:*:*:*:*:
- cpe:2.3:a:ibm_corporation:ibm_rational_build_forge:8.0.0.2:*:*:*:*:*:*:
http://www.ibm.com/support/pages/node/7063717
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
