Security Bulletin: Content Manager Enterprise Edition for March 2024 - CVE-2023-3894

Summary

Content Manager Enterprise Edition is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed.

Vulnerability Details

CVEID:CVE-2023-3894
**DESCRIPTION:**FasterXML jackson-dataformats-text is vulnerable to a denial of service, caused by a stackoverflow parsing TOML data. By sending a specially crafted TOML data, a remote attacker could exploit this vulnerability to causes the parser to crash, and results in a denial of service condition.
CVSS Base score: 5.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/263144 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L)

Affected Products and Versions

Remediation/Fixes

Fixed in Content Manager Enterprise Edition 8.7 fix pack 2

Workarounds and Mitigations

None