Lucene search

K
ibmIBM566F9302BA08F1D8788B02674EA2BD9DDA178E2E18D3727718EFA8102B7C32B2
HistorySep 04, 2023 - 11:19 a.m.

Security Bulletin: CVE-2023-34149 may affect Apache Struts used by Content Collector for Email, Content Collector for File Systems and Content Collector for Microsoft SharePoint

2023-09-0411:19:39
www.ibm.com
47
cve-2023-34149
apache struts
content collector
email
file systems
microsoft sharepoint
denial of service

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.012 Low

EPSS

Percentile

84.9%

Summary

CVE-2023-34149 reported in Apache Struts used by Content Collector for Email, Content Collector for File Systems and Content Collector for Microsoft SharePoint.

Vulnerability Details

CVEID:CVE-2023-34149
**DESCRIPTION:**Apache Struts is vulnerable to a denial of service, caused by a flaw with only handling setProperty() but not getProperty(). By sending a specially crafted request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/257947 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
Content Collector for Microsoft SharePoint 4.0.1
Content Collector for Email 4.0.1
Content Collector for File Systems 4.0.1

Remediation/Fixes

Product

| VRM|Remediation
—|—|—
Content Collector for Email| 4.0.1| Use Content Collector for Email 4.0.1.15-IBM-ICC-IF006
Content Collector for File Systems| 4.0.1| Use Content Collector for File Systems 4.0.1.15-IBM-ICC-IF006
Content Collector for Microsoft SharePoint| 4.0.1| Use Content Collector for Microsoft SharePoint 4.0.1.15-IBM-ICC-IF006

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmcontent_collectorMatch4.0.1
CPENameOperatorVersion
ibm content collectoreq4.0.1

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.012 Low

EPSS

Percentile

84.9%

Related for 566F9302BA08F1D8788B02674EA2BD9DDA178E2E18D3727718EFA8102B7C32B2