Improper input validation in MySQL Connectors - CVE-2023-22102

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU82144

Improper input validation in MySQL Connectors - CVE-2023-22102

Published: October 17, 2023


Vulnerability identifier: #VU82144
CSH Severity: High
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-22102
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The vulnerability exists due to improper input validation within the Connector/J component in MySQL Connectors. A remote non-authenticated attacker can exploit this vulnerability to execute arbitrary code.


Affected software

MySQL Connectors
Event Processing
IBM Cloud Pak for Watson AIOps
IBM Business Automation Manager Open Editions
Red Hat build of Quarkus
Oracle Communications Cloud Native Core Network Repository Function
Oracle Communications Cloud Native Core Network Exposure Function
IBM Edge Application Manager
Oracle Communications Cloud Native Core Unified Data Repository
watsonx.data
IBM InfoSphere Information Server

How to mitigate CVE-2023-22102

Install updates from vendor's website.

Event Processing - update to 1.1.5
Red Hat build of Quarkus - update to 3.2.10
watsonx.data - update to 2.0.3
IBM Cloud Pak for Watson AIOps - update to 4.7.0
IBM Business Automation Manager Open Editions - update to 8.0.6
IBM InfoSphere Information Server - update to 11.7.1 Fix Pack 5

External References

Related Security Bulletins