Input validation error in Spring Boot - CVE-2023-34055

Vulnerability identifier: #VU83581

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-34055

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in Web Observations. A remote attacker can send specially crafted HTTP requests to the application and perform a denial of service (DoS) attack.

Successful exploitation of the vulnerability requires that application is using Spring MVC or Spring WebFlux and that org.springframework.boot:spring-boot-actuator is on the classpath.

Spring Boot
QRadar Suite
Cloud Pak for Network Automation
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data
Storage Copy Data Management
IBM Cloud Pak for Watson AIOps
IBM Sterling B2B Integrator
IBM Sterling Partner Engagement Manager
Oracle Communications Unified Inventory Management
Oracle Financial Services Model Management and Governance
Oracle SD-WAN Edge
Oracle Communications Network Analytics Data Director
Oracle Communications Cloud Native Core Network Data Analytics Function
IBM Watson Discovery for IBM Cloud Pak for Data
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Sterling Connect:Direct Web Services
IBM Cloud Pak for Business Automation
IBM Observability with Instana
Oracle Financial Services Compliance Studio
Oracle Communications Cloud Native Core Unified Data Repository
Oracle Communications Cloud Native Core Service Communication Proxy
Oracle Communications Cloud Native Core Console
Oracle Communications Cloud Native Core Security Edge Protection Proxy
Fuse
Operational Decision Manager

Install updates from vendor's website.

Spring Boot - addressed in versions 2.7.18, 3.0.13, 3.1.6
QRadar Suite - update to 1.10.18.0
Cloud Pak for Network Automation - update to 2.7.2
watsonx Orchestrate Cartridge for IBM Cloud Pak for Data - update to 5.2
IBM Sterling B2B Integrator - addressed in versions 6.1.2.6, 6.2.0.3
IBM Sterling Partner Engagement Manager - addressed in versions 6.2.3.5, 6.2.4.2
Storage Copy Data Management - update to 2.2.26.0
IBM Cloud Pak for Watson AIOps - update to 4.5.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.8.2
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.8.2
IBM Sterling Connect:Direct Web Services - addressed in versions 6.1.0.24, 6.2.0.23, 6.3.0.7
Fuse - update to 7.13.0
Operational Decision Manager - addressed in versions 8.10.5.1 Interim fix 51, 8.11.0.1 Interim fix 27, 8.11.1 Interim fix 19, 8.12.0.1 Interim fix 1
IBM Cloud Pak for Business Automation - addressed in versions 21.0.3.28, 23.0.1.6
IBM Observability with Instana - update to 266

• https://spring.io/security/cve-2023-34055

• Multiple DoS vulnerabilities in Spring Boot server Web Observations
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Console
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Multiple vulnerabilities in IBM Watson Discovery
• Multiple vulnerabilities in IBM Operational Decision Manager
• Input validation error in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM QRadar Suite Software
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Multiple vulnerabilities in IBM Cloud Pak for Business Automation
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Multiple vulnerabilities in Oracle SD-WAN Edge
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Service Communication Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Security Edge Protection Proxy
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Unified Data Repository
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Network Data Analytics Function
• Multiple vulnerabilities in Oracle Communications Unified Inventory Management
• Multiple vulnerabilities in IBM Sterling Connect:Direct Web Services
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Multiple vulnerabilities in Fuse 7.13
• Multiple vulnerabilities in Oracle Financial Services Model Management and Governance
• Multiple vulnerabilities in Oracle Financial Services Compliance Studio
• IBM B2B Sterling Integrator update for Spring Boot
• Multiple vulnerabilities in IBM Storage Copy Data Management
• IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data update for Spring Boot
• Multiple vulnerabilities in IBM Sterling Partner Engagement Manager Essentials Edition