Input validation error in Spring Framework - CVE-2023-20861

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU75562

Input validation error in Spring Framework - CVE-2023-20861

Published: April 27, 2023


Vulnerability identifier: #VU75562
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-20861
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of SpEL expressions. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.


Affected software

Spring Framework
NetWorker
IBM Process Mining
IBM Watson Assistant for IBM Cloud Pak for Data
Dell Secure Connect Gateway
IBM Sterling B2B Integrator
Oracle SD-WAN Edge
Middleware Common Libraries and Tools
Oracle Enterprise Data Quality
Oracle Middleware Common Libraries and Tools
IBM Cloud Pak for Business Automation
Oracle Communications Cloud Native Core Binding Support Function
Oracle Communications Network Analytics Data Director
IBM Spectrum Conductor
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Spectrum Symphony
IBM Maximo Application Suite
IBM Common Licensing
IBM Business Automation Workflow
IBM Observability with Instana
Red Hat Openshift Application Runtimes
Traffix SDC
IBM Watson Explorer Foundational Components
IBM Watson Explorer Deep Analytics Edition Foundational Components
ObjectScale
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Dell Policy Manager for Secure Connect Gateway (SCG)
Oracle BI Publisher
Oracle FLEXCUBE Universal Banking
IBM Watson Machine Learning Accelerator
IBM i Modernization Engine for Lifecycle Integration
Cloud Pak for Network Automation
IBM ECM Content Management Interoperability Services
Maximo Application Suite - IoT Component
IBM Data Risk Manager
IBM Db2 Web Query for i
IBM Tivoli Application Dependency Discovery Manager
Oracle Banking Corporate Lending Process Management
Oracle Banking Liquidity Management
Oracle Banking Trade Finance Process Management
Oracle Banking Branch
Oracle Banking Supply Chain Finance
Oracle Banking Cash Management
Oracle Banking Credit Facilities Process Management
Red Hat Virtualization Manager
OpenShift Developer Tools and Services
Red Hat Camel for Spring Boot
Communications Unified Assurance
AMQ Broker
Fuse
IBM InfoSphere Information Server
Oracle Enterprise Manager for Fusion Middleware
Oracle Banking Corporate Lending
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Oracle Communications Cloud Native Core Policy
Oracle Communications Cloud Native Core Console
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
watsonx.data
Library Support for Spring
jenkins (Red Hat package)
ovirt-dependencies (Red Hat package)
ovirt-engine (Red Hat package)
jenkins-2-plugins (Red Hat package)
vdsm (Red Hat package)
Operational Decision Manager

How to mitigate CVE-2023-20861

Install updates from vendor's website.

Spring Framework - addressed in versions 5.2.23, 5.3.26, 6.0.7
ObjectScale - update to 1.3.0
IBM Process Mining - update to 1.14.0.0
IBM Data Risk Manager - update to 2.0.6.17
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
Dell Policy Manager for Secure Connect Gateway (SCG) - update to 5.16.00.14
Dell Secure Connect Gateway - update to 5.16
IBM Sterling B2B Integrator - addressed in versions 6.0.3.9, 6.1.0.8, 6.1.1.4, 6.1.2.3, 6.2.0.0
AMQ Broker - update to 7.10.3
IBM Watson Explorer Foundational Components - update to 11.0.2.16
IBM Watson Explorer Deep Analytics Edition Foundational Components - update to 12.0.3.12
Oracle Banking Corporate Lending - update to 14.4
Oracle Banking Corporate Lending Process Management - update to 14.7.0.0.0
Oracle FLEXCUBE Universal Banking - update to 14.7.0.0.0
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.20, 22.0.2.4
IBM Watson Machine Learning Accelerator - update to 1.2.3 601632-wmla
IBM i Modernization Engine for Lifecycle Integration - update to 1.4.2
Cloud Pak for Security (CP4S) - update to 1.10.12.0
watsonx.data - update to 2.1.1
IBM Spectrum Conductor - update to 2.5.1 FP2
Cloud Pak for Network Automation - update to 2.7
Library Support for Spring - update to 2.7.29
jenkins (Red Hat package) - addressed in versions 2.401.1.1686649641-3.el8, 2.401.1.1686680404-3.el8, 2.426.3.1706515686-3.el8
IBM ECM Content Management Interoperability Services - update to 3.0.7.0.2
Red Hat Camel for Spring Boot - update to 3.20.1
ovirt-dependencies (Red Hat package) - update to 4.5.3-1.el8ev
ovirt-engine (Red Hat package) - update to 4.5.3.8-2.el8ev
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.5
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.7
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.7
jenkins-2-plugins (Red Hat package) - addressed in versions 4.12.1686649756-1.el8, 4.12.1706515741-1.el8, 4.13.1686680473-1.el8
vdsm (Red Hat package) - update to 4.50.3.8-1.el8ev
IBM Spectrum Symphony - update to 7.3.2 Fix 601711
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
Fuse - update to 7.12.0
Maximo Application Suite - IoT Component - addressed in versions 8.7.15, 8.8.11, 9.0.1
IBM Maximo Application Suite - addressed in versions 8.9.6, 8.10.4
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 34, 8.11.0.1 Interim fix 17, 8.11.1 Interim fix 5
IBM Common Licensing - update to 9.0.0.1
IBM Business Automation Workflow - addressed in versions 21.0.3 IF020, 22.0.2 IF004
IBM Observability with Instana - update to 266

External References

Related Security Bulletins