Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM9018EBBB2B02EE47F1D399A0C2BDB34D3337938CEAB3DDDABC830CFAB6427187
HistoryMay 13, 2022 - 2:58 p.m.

Security Bulletin: IBM Sterling B2B Integrator vulnerable to multiple vulnerabilities due to Spring Framework

2022-05-1314:58:22
www.ibm.com
8

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.937 High

EPSS

Percentile

99.1%

JSON

Summary

Spring Framework is used by IBM Sterling B2B Integrator. Multiple vulnerabilities in Spring Framework have been addressed.

Vulnerability Details

CVEID:CVE-2016-9878
**DESCRIPTION:**Pivotal Spring Framework could allow a remote attacker to traverse directories on the system, caused by the failure to sanitize paths provided to ResourceServlet. An attacker could send a specially-crafted URL request containing directory traversal sequences to view arbitrary files on the system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/120241 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID:CVE-2020-5421
**DESCRIPTION:**VMware Tanzu Spring Framework could allow a remote attacker to bypass security restrictions, caused by improper input validation. By using a specially-crafted jsessionid path parameter, an attacker could exploit this vulnerability to bypass RFD Protection.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/188530 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

CVEID:CVE-2018-1257
**DESCRIPTION:**Pivotal Spring Framework is vulnerable to a denial of service. By sending a specially-crafted message, a remote attacker could exploit this vulnerability to perform a regular expression denial of service attack.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/143316 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2013-4152
**DESCRIPTION:**Pivotal Spring Framework could allow a remote attacker to obtain sensitive information, caused by an XML External Entity Injection (XXE) error when processing XML data. By sending a specially-crafted request, an attacker could exploit this vulnerability to read arbitrary files and obtain sensitive information.
CVSS Base score: 5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/86589 for the current score.
CVSS Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N)

Affected Products and Versions

Affected Product(s) APAR(s) Version(s)
IBM Sterling B2B Integrator IT40592 6.0.0.0 - 6.0.3.5
IBM Sterling B2B Integrator IT40592 6.1.0.0 - 6.1.0.4

Remediation/Fixes

Product(s) Version(s) Remediation/Fix
IBM Sterling B2B Integrator 6.0.0.0 - 6.0.3.5 Apply IBM Sterling B2B Integrator version 6.0.3.6 on Fix Central
IBM Sterling B2B Integrator 6.1.0.0 - 6.1.0.4 Apply IBM Sterling B2B Integrator version 6.1.1.0 or higher on Fix Central
Note that the fix may also be present in other releases. This can be verified by looking for the APAR number on the Fix List page

Workarounds and Mitigations

None

Related

veracode 3
nessus 13
debiancve 7
cve 8
redhatcve 3
ubuntucve 7
prion 8
github 7
openvas 9
fedora 1
osv 12
checkpoint_advisories 3
securityvulns 6
debian 3
mageia 2
ibm 29
redhat 9
githubexploit 1
f5 1
atlassian 1
ubuntu 1
oracle 17
veracode
veracode
Directory Traversal
2016-12-28 07:29:41
Regular Expression Denial Of Service (ReDoS)
2018-05-10 07:02:28
Reflected File Download (RFD) Attack
2020-09-18 08:14:19
nessus
nessus
Fedora 25 : springframework (2016-f341d71730)
2017-01-03 00:00:00
Debian DSA-2842-1 : libspring-java - denial of service
2014-01-14 00:00:00
Oracle Primavera P6 Enterprise Project Portfolio Management (Jan 2021 CPU)
2021-01-22 00:00:00
debiancve
debiancve
CVE-2016-9878
2016-12-29 09:59:00
CVE-2013-4152
2014-01-23 21:55:00
CVE-2018-1257
2018-05-11 20:29:00
cve
cve
CVE-2016-9878
2016-12-29 09:59:00
CVE-2013-4152
2014-01-23 21:55:00
CVE-2018-1257
2018-05-11 20:29:00
redhatcve
redhatcve
CVE-2016-9878
2016-12-22 11:17:24
CVE-2018-1257
2018-05-15 22:19:45
CVE-2020-5421
2020-09-21 16:59:07
ubuntucve
ubuntucve
CVE-2016-9878
2016-12-29 00:00:00
CVE-2013-4152
2014-01-23 00:00:00
CVE-2018-1257
2018-05-11 00:00:00
prion
prion
Directory traversal
2016-12-29 09:59:00
Xxe
2014-01-23 21:55:00
Code injection
2018-05-11 20:29:00
github
github
Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized
2018-10-04 20:29:55
Cross-Site Request Forgery in Spring Framework
2022-05-13 01:02:38
Denial of Service in org.springframework:spring-core
2018-10-17 20:02:20
openvas
openvas
Fedora Update for springframework FEDORA-2016-f341d71730
2017-01-04 00:00:00
Debian Security Advisory DSA 2842-1 (libspring-java - denial of service)
2014-01-13 00:00:00
Mageia: Security Advisory (MGASA-2014-0042)
2022-01-28 00:00:00
fedora
fedora
[SECURITY] Fedora 25 Update: springframework-3.2.18-1.fc25
2017-01-01 21:51:55
osv
osv
Pivotal Spring Framework Paths provided to the ResourceServlet were not properly sanitized
2018-10-04 20:29:55
libspring-java - several
2014-02-08 00:00:00
Cross-Site Request Forgery in Spring Framework
2022-05-13 01:02:38
checkpoint_advisories
checkpoint_advisories
SpringSource Spring Framework XML External Entity Information Disclosure (CVE-2013-4152)
2013-10-27 00:00:00
Multiple Products XML Public External Entity Information Disclosure (CVE-2013-3617; CVE-2013-4152; CVE-2013-6429; CVE-2014-0002; CVE-2014-0423)
2013-09-29 00:00:00
Multiple Products XML System External Entity Information Disclosure (CVE-2013-3617; CVE-2013-4152; CVE-2013-6429; CVE-2014-0002; CVE-2014-0054; CVE-2014-0423)
2013-09-29 00:00:00
securityvulns
securityvulns
CVE-2013-4152 XML External Entity (XXE) injection in Spring Framework
2013-09-09 00:00:00
CVE-2013-6429 Fix for XML External Entity (XXE) injection (CVE-2013-4152) in Spring Framework was incomplete
2014-01-19 00:00:00
CVE-2014-0054 Spring MVC Incomplete fix for CVE-2013-4152 / CVE-2013-6429 (XXE)
2014-05-05 00:00:00
debian
debian
[SECURITY] [DSA 2842-1] libspring-java security update
2014-01-13 16:06:06
[SECURITY] [DSA 2857-1] libspring-java security update
2014-02-08 14:41:58
[SECURITY] [DLA 1853-1] libspring-java security update
2019-07-13 21:20:48
mageia
mageia
Updated springframework packages fix CVE-2013-4152
2014-02-10 23:51:48
Updated springframework package fixes security vulnerabilities
2014-02-26 01:35:01
ibm
ibm
Security Bulletin: Spring Framework vulnerabilities affect IBM Watson Text to Speech and Speech to Text (IBM Watson Speech Services for Cloud Pak for Data 1.2)
2020-12-16 17:55:27
Security Bulletin: Spring Framework as used by IBM QRadar SIEM is vulnerable to improper input validation (CVE-2020-5421)
2021-01-27 00:09:26
Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Spring
2021-02-27 03:38:50
redhat
redhat
(RHSA-2014:0212) Moderate: Red Hat JBoss SOA Platform 5.3.1 update
2014-02-25 16:33:00
(RHSA-2017:3115) Moderate: Red Hat JBoss Fuse/A-MQ 6.3 R5 security and bug fix update
2017-11-02 20:06:29
(RHSA-2018:1809) Important: Red Hat OpenShift Application Runtimes Spring Boot security and bug fix update
2018-06-07 08:25:02
githubexploit
githubexploit
Exploit for Vulnerability in Pivotal Software Spring Framework
2021-01-10 12:26:00
f5
f5
K31022653 : Spring Framework vulnerability CVE-2018-1257
2018-05-24 00:00:00
atlassian
atlassian
Insecure version of Spring Web MVC used in Confluence Analytics
2020-02-19 22:31:10
ubuntu
ubuntu
Spring Framework vulnerabilities
2021-03-17 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - July 2019
2019-07-16 00:00:00
Oracle Critical Patch Update - April 2018
2018-04-17 00:00:00
Oracle Critical Patch Update - January 2018
2018-01-16 00:00:00

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.937 High

EPSS

Percentile

99.1%

JSON
Related for 9018EBBB2B02EE47F1D399A0C2BDB34D3337938CEAB3DDDABC830CFAB6427187
veracode3nessus13debiancve7cve8redhatcve3ubuntucve7prion8github7openvas9fedora1osv12checkpoint_advisories3securityvulns6debian3mageia2ibm29redhat9githubexploit1f51atlassian1ubuntu1oracle17