Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM20C255DC327324AD085361AFABCA90098DD28DCAB57E90E85DABF3735C230A09
HistoryJul 20, 2023 - 4:33 p.m.

Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in VMware Tanzu Spring Framework (CVE-2023-20863)

2023-07-2016:33:05
www.ibm.com
15
ibm
infosphere information server
vmware tanzu spring framework
vulnerability
denial of service
cve-2023-20863
security patch
ibm cloud
remediation
apar
infosphere information server 11.7
mitigation

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.003 Low

EPSS

Percentile

69.8%

JSON

Summary

A vulnerability in VMware Tanzu Spring Framework used by IBM InfoSphere Information Server was addressed.

Vulnerability Details

CVEID:CVE-2023-20863
**DESCRIPTION:**VMware Tanzu Spring Framework is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted SpEL expression, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/252807 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
InfoSphere Information Server 11.7

Remediation/Fixes

Product VRMF APAR Remediation
InfoSphere Information Server, InfoSphere Information Server on Cloud 11.7 DT215244 --Apply IBM InfoSphere Information Server version 11.7.1.0
--Apply InfoSphere Information Server version 11.7.1.4
--Apply InfoSphere Information Server 11.7.1.4 Service pack 1
--Apply Information Server Microservices tier security patch
--Apply Information Server Framework security patch
--Apply Information Governance Catalog security patch
--Apply Information Server Workflow security patch

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibminfosphere_information_serverMatch11.7

Related

broadcom 1
ubuntucve 1
nvd 1
openvas 2
ibm 31
redhatcve 1
veracode 1
cve 1
osv 2
github 1
prion 1
debiancve 1
cvelist 1
redhat 2
nessus 3
oracle 4
broadcom
broadcom
Spring Expression DoS Vulnerability (CVE-2023-20863)
2024-04-16 00:00:00
ubuntucve
ubuntucve
CVE-2023-20863
2023-04-13 00:00:00
nvd
nvd
CVE-2023-20863
2023-04-13 20:15:07
openvas
openvas
VMware Spring Framework < 5.2.24, 5.3.x < 5.3.27, 6.0.x < 6.0.8 DoS Vulnerability - Linux
2023-04-14 00:00:00
VMware Spring Framework < 5.2.24, 5.3.x < 5.3.27, 6.0.x < 6.0.8 DoS Vulnerability - Windows
2023-04-14 00:00:00
ibm
ibm
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to VMware Tanzu Spring Framework denial of service vulnerabilitiy [CVE-2023-20863]
2023-07-20 16:39:20
Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in VMware Tanzu Spring Framework
2023-06-28 22:02:35
Security Bulletin: Vulnerability in Spring Framework affects IBM Process Mining . CVE-2023-20863
2023-06-27 11:11:19
redhatcve
redhatcve
CVE-2023-20863
2023-04-18 15:31:05
veracode
veracode
Denial Of Service (DoS)
2023-04-18 07:02:49
cve
cve
CVE-2023-20863
2023-04-13 20:15:07
osv
osv
CVE-2023-20863
2023-04-13 20:15:07
Spring Framework vulnerable to denial of service
2023-04-13 21:30:27
github
github
Spring Framework vulnerable to denial of service
2023-04-13 21:30:27
prion
prion
Race condition
2023-04-13 20:15:00
debiancve
debiancve
CVE-2023-20863
2023-04-13 20:15:07
cvelist
cvelist
CVE-2023-20863
2023-04-13 00:00:00
redhat
redhat
(RHSA-2023:2099) Important: Red Hat Integration Camel for Spring Boot 3.18.3 Patch 1 security update
2023-05-03 14:03:45
(RHSA-2023:2100) Important: Red Hat Integration Camel for Spring Boot 3.20.1 security update
2023-05-03 14:03:49
nessus
nessus
Oracle Primavera Gateway (Jul 2023 CPU)
2023-07-19 00:00:00
Oracle MySQL Enterprise Monitor (October 2023 CPU)
2023-10-19 00:00:00
Oracle WebLogic Server (July 2023 CPU)
2023-07-20 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - October 2023
2023-10-17 00:00:00
Oracle Critical Patch Update Advisory - January 2024
2024-01-16 00:00:00
Oracle Critical Patch Update Advisory - July 2023
2023-07-18 00:00:00

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.003 Low

EPSS

Percentile

69.8%

JSON
Related for 20C255DC327324AD085361AFABCA90098DD28DCAB57E90E85DABF3735C230A09
broadcom1ubuntucve1nvd1openvas2ibm31redhatcve1veracode1cve1osv2github1prion1debiancve1cvelist1redhat2nessus3oracle4