Permissions, Privileges, and Access Controls in IBM DB2 - CVE-2023-47145

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU85165

Permissions, Privileges, and Access Controls in IBM DB2 - CVE-2023-47145

Published: January 9, 2024


Vulnerability identifier: #VU85165
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-47145
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions. A local user can trigger the vulnerability to bypass security restrictions and escalate privileges to the SYSTEM user using the MSI repair functionality


Affected software

IBM DB2
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Operations Analytics Predictive Insights
IBM Intelligent Operations Center
WebSphere Remote Server
IBM Security Verify Governance
IBM Cloud Application Performance Management (APM)
IBM OpenPages with Watson
Datacap
dashDB Local
DB2 Warehouse on Cloud Pak for Data
DB2 on Cloud Pak for Data
Storage Protect Server

How to mitigate CVE-2023-47145

Install updates from vendor's website.

IBM DB2 - addressed in versions 10.5 FP11, 11.1.4.7, 11.5.8, 11.5.9
dashDB Local - update to 11.5.9.0
DB2 Warehouse on Cloud Pak for Data - update to 4.8.2
DB2 on Cloud Pak for Data - update to 4.8.2
IBM Cloud Application Performance Management (APM) - update to 8.1.4.0.15
Storage Protect Server - update to 8.1.22

External References

Related Security Bulletins