Main Vulnerability Database Vulnerabilities #VU83100

Input validation error in OLE DB Provider for DB2 V7 and Microsoft Host Integration Server - CVE-2023-38151

Published: November 14, 2023

Vulnerability identifier: #VU83100

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-38151

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Microsoft Host Integration Server 2020. A remote attacker can trick a victim to connect to the malicious DB2 server and execute arbitrary code on the target system.

Affected software

OLE DB Provider for DB2 V7
Microsoft Host Integration Server

How to mitigate CVE-2023-38151

Install updates from vendor's website.

External References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38151

Related Security Bulletins