Information disclosure in IBM Java SDK - CVE-2023-30441

Vulnerability identifier: #VU75508

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2023-30441

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
IBM Java SDK
Rational Business Developer (RBD)
IBM InfoSphere Information Server
IBM DB2
Host On-Demand
InfoSphere Data Replication
Rational Synergy
Tivoli System Automation for Multiplatforms
InfoSphere Global Name Management
Storage Protect Server
WebSphere Service Registry and Repository Studio
IBM Virtualization Engine TS7700 3948-VED
IBM MQ Appliance
IBM VIOS
IBM AIX
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Software Development Kit 12
SUSE CaaS Platform
SUSE Manager Server
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE Enterprise Storage
IBM i
SUSE OpenStack Cloud Crowbar
SUSE OpenStack Cloud
SUSE Linux Enterprise Server 12 SP2 BCL
SUSE Linux Enterprise Server 12 SP4 LTSS
SUSE Linux Enterprise Server 12 SP4 ESPOS
SUSE Linux Enterprise Server 15 SP1 LTSS
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
Legacy Module
openSUSE Leap
WebSphere Service Registry and Repository
IBM Business Automation Workflow
z/Transaction Processing Facility ( z/TPF)
IBM Intelligent Operations Center
IBM Rational Build Forge
Netcool/OMNIbus
IBM Common Licensing
IBM Operations Analytics Predictive Insights
IBM Tivoli System Automation Application Manager
IBM Sterling Connect:Direct Web Services
IBM Tivoli Business Service Manager
IBM Tivoli Netcool Impact
IBM Cloud Application Performance Management (APM)
IBM MQ
IBM Cloud Pak for Business Automation
SPSS Statistics
IBM Data Risk Manager
IBM Tivoli Application Dependency Discovery Manager
Sterling Connect:Direct Browser User Interface
IBM Cloud Pak for Multicloud Management
IBM Data Studio Client
IBM Tivoli Network Manager (ITNM)
DB2 Recovery Expert for LUW
IBM Copy Services Manager
IBM Qradar SIEM
java-1_8_0-ibm
java-1_8_0-ibm-alsa
java-1_8_0-ibm-plugin
java-1_8_0-ibm-devel
java-1_8_0-ibm-demo
java-1_8_0-ibm-src
java-1_8_0-ibm-32bit
java-1_8_0-ibm-devel-32bit
IBM Cloud Pak System
IBM Spectrum Virtualize
Virtualization Engine TS7700 3957-VEC

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to sensitive information on the system.

Install updates from vendor's website.

• https://www.ibm.com/support/pages/node/6985011