SQL injection in IBM DB2 LUW - CVE-2023-38740

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU82577

SQL injection in IBM DB2 LUW - CVE-2023-38740

Published: October 31, 2023


Vulnerability identifier: #VU82577
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-38740
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.


Affected software

IBM DB2 LUW
IBM DB2
IBM License Metric Tool
IBM Tivoli Business Service Manager
IBM Operations Analytics Predictive Insights
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Intelligent Operations Center
WebSphere Remote Server
IBM Security Verify Governance
IBM Cloud Application Performance Management (APM)
Db2 Big SQL
dashDB Local
Storage Protect Server
IBM Cloud Pak System

How to mitigate CVE-2023-38740

Install updates from vendor's website.

Db2 Big SQL - update to 7.6
dashDB Local - update to 11.5.9.0
IBM Cloud Pak System - addressed in versions 2.3.4.1, 2.3.5.0
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
Storage Protect Server - update to 8.1.21
IBM DB2 - addressed in versions 11.5.0.0, 11.5.7, 11.5.8

External References

Related Security Bulletins