Input validation error in Spring Framework - CVE-2023-20863

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU75409

Input validation error in Spring Framework - CVE-2023-20863

Published: April 21, 2023


Vulnerability identifier: #VU75409
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-20863
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote user can use a specially crafted SpEL expression and perform a denial of service (DoS) attack.


Affected software

Spring Framework
IBM Business Automation Workflow
IBM Watson Assistant for IBM Cloud Pak for Data
Dell Secure Connect Gateway
IBM Sterling B2B Integrator
Oracle Communications Network Integrity
Oracle Communications Unified Inventory Management
Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
Oracle Financial Services Behavior Detection Platform
Oracle Financial Services Enterprise Case Management
Oracle Healthcare Data Repository
Oracle Financial Services Model Management and Governance
Oracle Communications Session Report Manager
Oracle Identity Manager Connector
Oracle SD-WAN Edge
Oracle Enterprise Data Quality
Oracle Banking APIs
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Cloud Native Core Binding Support Function
IBM Process Mining
IBM Spectrum Conductor
IBM MaaS360 Mobile Enterprise Gateway
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Spectrum Symphony
IBM SPSS Collaboration and Deployment Services
IBM Maximo Application Suite
IBM Common Licensing
IBM Security Verify Governance
IBM Cloud Pak for Business Automation
IBM Observability with Instana
ObjectScale
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Oracle Healthcare Master Person Index
Dell Policy Manager for Secure Connect Gateway (SCG)
Oracle Financial Services Analytical Applications Infrastructure
Oracle FLEXCUBE Universal Banking
Oracle FLEXCUBE Investor Servicing
Oracle Retail Xstore Point of Service
Oracle Banking Digital Experience
IBM Watson Machine Learning Accelerator
IBM i Modernization Engine for Lifecycle Integration
Cloud Pak for Network Automation
IBM ECM Content Management Interoperability Services
Big Replicate LiveData Migrator
IBM Cloud Pak for Watson AIOps
Maximo Application Suite - IoT Component
Oracle Insurance Policy Administration Operational Data Store for Life and Annuity
IBM Db2 Web Query for i
Oracle Utilities Testing Accelerator
IBM Tivoli Application Dependency Discovery Manager
Oracle Communications Element Manager
Identity Manager Connector
Oracle Banking Supply Chain Finance
Oracle Banking Liquidity Management
Oracle Banking Credit Facilities Process Management
Oracle Banking Virtual Account Management
Oracle Banking Trade Finance Process Management
Oracle Banking Origination
Oracle Banking Electronic Data Exchange for Corporates
Oracle Banking Cash Management
Oracle Banking Branch
Oracle Solaris Cluster
MySQL Enterprise Monitor
Oracle Communications BRM - Elastic Charging Engine
IBM InfoSphere Information Server
IBM Watson Explorer Foundational Components
IBM Watson Explorer Deep Analytics Edition Foundational Components
Oracle Commerce Platform
Oracle Commerce Guided Search
Oracle Retail Financial Integration
Oracle Retail Fiscal Management
Oracle Retail Customer Management and Segmentation Foundation
Oracle WebLogic Server
Oracle Retail Predictive Application Server
Primavera Gateway
Oracle Documaker
Operational Decision Manager
Oracle Retail Integration Bus
Oracle Banking Corporate Lending
RSA Authentication Manager
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Policy
Cloud Foundry UAA
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
watsonx.data
Library Support for Spring
IBM MaaS360 VPN Module
Red Hat Camel for Spring Boot

How to mitigate CVE-2023-20863

Install updates from vendor's website.

Spring Framework - addressed in versions 5.2.24, 5.3.27, 6.0.8
ObjectScale - update to 1.3.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
Dell Policy Manager for Secure Connect Gateway (SCG) - update to 5.16.00.14
Dell Secure Connect Gateway - update to 5.16
IBM Sterling B2B Integrator - addressed in versions 6.0.3.9, 6.1.0.8, 6.1.1.4, 6.1.2.3, 6.2.0.0
IBM Watson Explorer Foundational Components - update to 11.0.2.16
IBM Watson Explorer Deep Analytics Edition Foundational Components - update to 12.0.3.12
Cloud Foundry UAA - update to 76.10.0
IBM Watson Machine Learning Accelerator - update to 1.2.3 601632-wmla
IBM i Modernization Engine for Lifecycle Integration - update to 1.4.2
Cloud Pak for Security (CP4S) - update to 1.10.12.0
IBM Process Mining - update to 1.14.1
watsonx.data - update to 2.1.1
IBM Spectrum Conductor - update to 2.5.1 FP2
Cloud Pak for Network Automation - update to 2.7
Library Support for Spring - update to 2.7.29
IBM ECM Content Management Interoperability Services - update to 3.0.7.0.2
IBM MaaS360 Mobile Enterprise Gateway - update to 3.000.200
IBM MaaS360 VPN Module - update to 3.000.200
Big Replicate LiveData Migrator - update to 3.2.1
IBM Cloud Pak for Watson AIOps - update to 3.7.2
Red Hat Camel for Spring Boot - addressed in versions 3.18.3 Patch 1, 3.20.1
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.7.0
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.7
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.7
IBM Spectrum Symphony - update to 7.3.2 Fix 601711
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
IBM SPSS Collaboration and Deployment Services - update to 8.5.0.0.22
RSA Authentication Manager - update to 8.7 SP1 Patch 1
Maximo Application Suite - IoT Component - addressed in versions 8.7.15, 8.8.11, 9.0.1
IBM Maximo Application Suite - addressed in versions 8.9.6, 8.10.4
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 36, 8.11.0.1 Interim fix 17, 8.11.0.1 Interim fix 18, 8.11.1 Interim fix 7
IBM Common Licensing - update to 9.0.0.1
IBM Security Verify Governance - update to 10.0.2.0.2
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.21, 22.0.2.5
IBM Observability with Instana - update to 266

External References

Related Security Bulletins