Input validation error in Spring Framework - CVE-2023-34053

Vulnerability identifier: #VU83582

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-34053

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input in Web Observations. A remote attacker can send specially crafted HTTP requests to the application and perform a denial of service (DoS) attack.

Spring Framework
spring-boot
QRadar Suite
IBM Process Mining
Oracle Communications Network Analytics Data Director
Management Cloud Engine
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Security Verify Governance
IBM Observability with Instana
Cloud Pak for Network Automation
CICS Transaction Gateway Desktop Edition
CICS Transaction Gateway for Multiplatforms
IBM Cloud Pak for Watson AIOps
Oracle Communications BRM - Elastic Charging Engine
IBM InfoSphere Information Server
Oracle Retail Merchandising System

Install updates from vendor's website.

Spring Framework - update to 6.0.14
QRadar Suite - update to 1.10.18.0
IBM Process Mining - update to 1.14.4
spring-boot - addressed in versions 2.7.18, 3.0.13, 3.1.6
Cloud Pak for Network Automation - update to 2.7.2
Oracle Communications BRM - Elastic Charging Engine - update to 12.0.0.8.0
IBM Cloud Pak for Watson AIOps - update to 4.4.0
IBM Watson Assistant for IBM Cloud Pak for Data - update to 5.0
IBM Security Verify Governance - update to 10.0.2.0.3
IBM InfoSphere Information Server - update to 11.7.1.4 Service pack 2
IBM Observability with Instana - update to 266

• https://spring.io/security/cve-2023-34053

• Denial of service in Spring Framework
• Multiple DoS vulnerabilities in Spring Boot server Web Observations
• Multiple vulnerabilities in Oracle Communications Network Analytics Data Director
• Multiple vulnerabilities in IBM QRadar Suite Software
• Multiple vulnerabilities in IBM Observability with Instana (OnPrem)
• Input validation error in IBM InfoSphere Information Server
• Multiple vulnerabilities in IBM Cloud Pak for AIOps
• Input validation error in IBM Process Mining
• Multiple vulnerabilities in Management Cloud Engine
• Multiple vulnerabilities in Oracle Communications BRM - Elastic Charging Engine
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• Input validation error in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in Oracle Retail Merchandising System
• Multiple vulnerabilities in IBM CICS Transaction Gateway for Multiplatforms
• Multiple vulnerabilities in CICS Transaction Gateway Desktop Edition