Uncaught Exception in engine.io - CVE-2023-31125

Vulnerability identifier: #VU76616

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-31125

CWE-ID: CWE-248

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to perform denial of service attacks.

The vulnerability exists due to an uncaught exception. A remote user can send specially crafted HTTP request to trigger the vulnerability and perform denial of service attacks.

engine.io
Answer Retrieval for Watson Discovery On Prem
Fedora
magicmirror
IBM Cloud Transformation Advisor
IBM Watson Knowledge Catalog in Cloud Pak for Data
IBM Decision Optimization for Cloud Pak for Data
App Connect Enterprise Certified Container

Install updates from vendor's website.

engine.io - update to 6.4.2
Answer Retrieval for Watson Discovery On Prem - update to 2.12.0
magicmirror - update to 2.24.0-1.fc39
IBM Cloud Transformation Advisor - update to 3.5.2
IBM Watson Knowledge Catalog in Cloud Pak for Data - update to 4.7
IBM Decision Optimization for Cloud Pak for Data - update to 4.7.2
App Connect Enterprise Certified Container - addressed in versions 5.0.7, 8.2.0

• https://github.com/socketio/engine.io/releases/tag/6.4.2
• https://github.com/socketio/engine.io/commit/fc480b4f305e16fe5972cf337d055e598372dc44
• https://github.com/socketio/engine.io/security/advisories/GHSA-q9mw-68c2-j6m5

• Multiple vulnerabilities in IBM Cloud Transformation Advisor
• Uncaught exception in IBM App Connect Enterprise Certified Container
• Multiple vulnerabilities in IBM Watson Knowledge Catalog for IBM Cloud Pak for Data
• Fedora 39 update for magicmirror
• Uncaught exception in IBM Decision Optimization for Cloud Pak for Data
• Multiple vulnerabilities in IBM Answer Retrieval for Watson Discovery