IBMA5EDB9BEF8327FE7B19D0094DE767B7584EEF69827A6298AF00EB1CAA22BEB55Security Bulletin: IBM Event Processing is vulnerable to Improper Input Validation due to the PostCSS (CVE-2023-44270).
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
6.6 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.6%
Summary
Operator of IBM Event Processing is vulnerable to Improper Input Validation due to the postcss-8.4.21.tgz before 8.4.31. PostCSS is a tool for transforming CSS with JavaScript plugins and this is a dev dependency used by Event Processing Team. (CVE-2023-44270).
Vulnerability Details
CVEID:CVE-2023-44270
**DESCRIPTION:**PostCSS could allow a remote attacker to bypass security restrictions, caused by improper input validaiton. By using a specially crafted external Cascading Style Sheets (CSS), an attacker could exploit this vulnerability to cause \r discrepancies in linters.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/267473 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Event Processing | 1.0.0-1.0.5 |
Remediation/Fixes
IBM strongly recommends addressing the vulnerability now by upgrading
Upgrade to IBM Event Processing 1.1.0 by following the upgrading and migrating documentation.
Workarounds and Mitigations
None
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm event automation | eq | any |
Related
5.3 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
6.6 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
20.6%