IBM DB2 Cross-Site Request Forgery Vulnerability (CNVD-2023-00813)

2022-12-1500:00:00

China National Vulnerability Database

www.cnvd.org.cn

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

JSON

IBM DB2 is a relational database management system from International Business Machines (IBM), Inc. The system is implemented in UNIX, Linux, IBMi, z/OS, and Windows server versions.IBM DB2 is vulnerable to cross-site request forgery, which can be exploited by an attacker to perform malicious and unauthorized operations transmitted from a user trusted by the site.

CPENameOperatorVersion
ibm db2 warehouse on cloud pak for dataeq3.5
ibm db2 warehouse on cloud pak for dataeq4.0
ibm db2 on cloud pak for dataeq3.5
ibm db2 on cloud pak for dataeq4.0
ibm db2 on cloud pak for dataeq4.5
ibm db2 warehouse on cloud pak for dataeq4.5

Name	Operator	Version
ibm db2 warehouse on cloud pak for data	eq	3.5
ibm db2 warehouse on cloud pak for data	eq	4.0
ibm db2 on cloud pak for data	eq	3.5
ibm db2 on cloud pak for data	eq	4.0
ibm db2 on cloud pak for data	eq	4.5
ibm db2 warehouse on cloud pak for data	eq	4.5