Lucene search

IBM643CB9202CC7419564AD2D7B1167969596817347051128C9E47699DB525822F5

HistoryMar 27, 2023 - 8:13 p.m.

Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to remote code execution from Apache Commons Net (CVE-2021-37533)

2023-03-2720:13:40

www.ibm.com

ibm tivoli netcool impact

remote code execution

apache commons net

vulnerability

cve-2021-37533

upgrade

version 7.1.0 fp29

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

0.003

Percentile

65.4%

JSON

Summary

Apache Common Net is used by IBM Tivoli Netcool Impact to provide telnet connectivity for the CommandResponse service. IBM Tivoli Netcool Impact has addressed the applicable CVE.

Vulnerability Details

**CVEID:**CVE-2021-37533 DESCRIPTION: Apache Commons Net could allow a remote attacker to obtain sensitive information, caused by an issue with the FTP client trusts the host from PASV response by default. By persuading a victim to connect to specially-crafted server, an attacker could exploit this vulnerability to obtain information about services running on the private network, and use this information to launch further attacks against the affected system.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241253 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Tivoli Netcool Impact	7.1.0

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

Product	VRMF	APAR	Remediation
IBM Tivoli Netcool Impact 7.1.0	7.1.0.0 - 7.1.0.28	IJ45096	Upgrade to IBM Tivoli Netcool Impact 7.1.0 FP29

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmtivoli_netcool\/impactMatch7.1.0

VendorProductVersionCPE
ibmtivoli_netcool\/impact7.1.0cpe:2.3:a:ibm:tivoli_netcool\/impact:7.1.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	tivoli_netcool\/impact	7.1.0	cpe:2.3:a:ibm:tivoli_netcool\/impact:7.1.0:::::::*

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

6.3

Confidence

High

EPSS

0.003

Percentile

65.4%

JSON

Related for 643CB9202CC7419564AD2D7B1167969596817347051128C9E47699DB525822F5