Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMA806BC59A4060B4A6ABABA0889A50CFF317CD2B7178ADC1CADAD88448C8B5342
HistoryOct 31, 2023 - 7:41 a.m.

Security Bulletin: Vulnerability in jetty-server-9.4.48.v20220622.jar affects IBM Integrated Analytics System (Sailfish) [CVE-2023-26048]

2023-10-3107:41:58
www.ibm.com
84
jetty server
ibm integrated analytics system
vulnerability
upgrade
fix central

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.4%

JSON

Summary

The jetty-server-9.4.48.v20220622.jar package is used by IBM Integrated Analytics System . IBM Integrated Analytics System has addressed the applicable CVE [ CVE-2023-26048].

Vulnerability Details

CVEID:CVE-2023-26048
**DESCRIPTION:**Eclipse Jetty is vulnerable to a denial of service, caused by an out of memory flaw in the HttpServletRequest.getParameter() or HttpServletRequest.getParts() function. By sending a specially crafted multipart request, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/253356 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Integrated Analytics System 1.0.0-1.0.28.0

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading to latest version.

Affected Product(s) VRMF Remediation/Fixes
IBM Integrated Analytics System 1.0.28.1 Link to Fix Central

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmsmart_analytics_system_7700Matchany
CPENameOperatorVersion
ibm integrated analytics systemeqany

Related

osv 4
ubuntucve 1
redhatcve 1
githubexploit 1
veracode 1
cve 1
prion 1
cgr 1
cvelist 1
nvd 1
ibm 28
debiancve 1
github 1
wolfi 1
nessus 11
openvas 4
redhat 13
debian 2
oracle 2
osv
osv
OutOfMemoryError for large multipart without filename in Eclipse Jetty
2023-04-19 18:15:45
CVE-2023-26048
2023-04-18 21:15:08
jetty9 - security update
2023-09-30 00:00:00
ubuntucve
ubuntucve
CVE-2023-26048
2023-04-18 00:00:00
redhatcve
redhatcve
CVE-2023-26048
2023-08-31 01:30:14
githubexploit
githubexploit
Exploit for Uncontrolled Resource Consumption in Eclipse Jetty
2023-11-01 06:57:10
veracode
veracode
Denial Of Service (DOS)
2023-04-20 14:24:08
cve
cve
CVE-2023-26048
2023-04-18 21:15:08
prion
prion
Design/Logic Flaw
2023-04-18 21:15:00
cgr
cgr
CVE-2023-26048 vulnerabilities
2024-05-19 03:07:16
cvelist
cvelist
CVE-2023-26048 OutOfMemoryError for large multipart without filename in Eclipse Jetty
2023-04-18 20:30:20
nvd
nvd
CVE-2023-26048
2023-04-18 21:15:08
ibm
ibm
Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Eclipse Jetty (CVE-2023-26048)
2023-07-17 03:56:06
Security Bulletin: Vulnerability in jetty-server affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2023-26048]
2023-07-31 10:47:25
Security Bulletin: Vulnerability in jetty-server affects IBM Cloud Pak for Data System 2.0 (CPDS 2.0)[CVE-2023-26048]
2024-03-06 06:30:15
debiancve
debiancve
CVE-2023-26048
2023-04-18 21:15:08
github
github
OutOfMemoryError for large multipart without filename in Eclipse Jetty
2023-04-19 18:15:45
wolfi
wolfi
CVE-2023-26048 vulnerabilities
2024-06-26 15:33:03
nessus
nessus
SUSE SLED15 / SLES15 / openSUSE 15 Security Update : jetty-minimal (SUSE-SU-2023:2539-1)
2023-06-20 00:00:00
Debian DLA-3592-1 : jetty9 - LTS security update
2023-10-01 00:00:00
Debian DSA-5507-1 : jetty9 - security update
2023-09-29 00:00:00
openvas
openvas
Eclipse Jetty Multiple Vulnerabilities (GHSA-qw69-rqj8-6qw8, GHSA-p26g-97m4-6q7c) - Windows
2023-04-21 00:00:00
Eclipse Jetty Multiple Vulnerabilities (GHSA-qw69-rqj8-6qw8, GHSA-p26g-97m4-6q7c) - Linux
2023-04-21 00:00:00
Debian: Security Advisory (DLA-3592-1)
2023-10-02 00:00:00
redhat
redhat
(RHSA-2024:3385) Moderate: Red Hat JBoss EAP 7.4.14 XP 4.0.2.GA security release
2024-05-28 11:17:57
(RHSA-2023:7637) Important: Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 7 security update
2023-12-04 17:37:49
(RHSA-2023:7641) Important: Red Hat JBoss Enterprise Application Platform 7.4.14 security update
2023-12-04 18:00:34
debian
debian
[SECURITY] [DLA 3592-1] jetty9 security update
2023-09-30 12:35:53
[SECURITY] [DSA 5507-1] jetty9 security update
2023-09-28 22:37:26
oracle
oracle
Oracle Critical Patch Update Advisory - October 2023
2023-10-17 00:00:00
Oracle Critical Patch Update Advisory - July 2023
2023-07-18 00:00:00

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

6.6 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.4%

JSON
Related for A806BC59A4060B4A6ABABA0889A50CFF317CD2B7178ADC1CADAD88448C8B5342
osv4ubuntucve1redhatcve1githubexploit1veracode1cve1prion1cgr1cvelist1nvd1ibm28debiancve1github1wolfi1nessus11openvas4redhat13debian2oracle2