Insufficient Logging in IBM DB2 - CVE-2023-23487

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU81946

Insufficient Logging in IBM DB2 - CVE-2023-23487

Published: October 12, 2023


Vulnerability identifier: #VU81946
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-23487
CWE-ID: CWE-778
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to modify data on the system.

The vulnerability exists due to insufficient audit logging. A remote user can trigger the vulnerability to modify data on the system.


Affected software

IBM DB2
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Intelligent Operations Center
IBM Operations Analytics Predictive Insights
WebSphere Remote Server
IBM Security Verify Governance
IBM Cloud Application Performance Management (APM)
IBM License Metric Tool
IBM OpenPages with Watson
dashDB Local
DB2 on Cloud Pak for Data
DB2 Warehouse on Cloud Pak for Data
Db2 Big SQL
Storage Protect Server
IBM Cloud Pak System

How to mitigate CVE-2023-23487

Install updates from vendor's website.

IBM DB2 - addressed in versions 10.5 FP11, 11.1.4.7, 11.5.7, 11.5.8
dashDB Local - update to 11.5.9.0
IBM Cloud Pak System - update to 2.3.3.7 iFix 01
DB2 on Cloud Pak for Data - update to 4.7.3
DB2 Warehouse on Cloud Pak for Data - update to 4.7.3
Db2 Big SQL - update to 7.5.3
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.4
Storage Protect Server - update to 8.1.20

External References

Related Security Bulletins