Security Bulletin: IBM Sterling Partner Engagement Manager is impacted by WebSphere Application Server Liberty DoS Vulnerability

2024-07-1520:04:58

www.ibm.com

ibm sterling partner engagement manager

websphere application server liberty

denial of service vulnerability

cve-2023-38737

security bulletin

remediation

ibm x-force id

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

0.001

Percentile

46.0%

JSON

Summary

IBM Sterling Partner Engagement Manager has addressed a WebSphere Application Server Liberty denial of service vulnerability, denial of service (CVE-2023-38737) vulnerability.

Vulnerability Details

CVEID:CVE-2023-38737
**DESCRIPTION:**IBM WebSphere Application Server Liberty 22.0.0.13 through 23.0.0.7 is vulnerable to a denial of service, caused by sending a specially-crafted request. A remote attacker could exploit this vulnerability to cause the server to consume memory resources. IBM X-Force ID: 262567.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/262567 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
PEM	6.2.1.x
PEM	6.2.2.x
PEM	6.1.2.x
PEM	6.2.3
PEM	6.2.0.x

Remediation/Fixes

Product	Version(s)	Remediation/Fix/Instructions
IBM Sterling Partner Engagement Manager Essentials Edition	6.2.3.1, 6.1.2.10, 6.2.0.8	Download 6.2.3.1 and follow installation instructions
IBM Sterling Partner Engagement Manager Standard Edition	6.2.3.1, 6.1.2.10, 6.2.0.8	Download 6.2.3.1 and follow installation instructions

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmsterling_partner_engagement_managerMatch6.2.2

ibmsterling_partner_engagement_managerMatch62.0

ibmsterling_partner_engagement_managerMatch6.1.2

VendorProductVersionCPE
ibmsterling_partner_engagement_manager6.2.2cpe:2.3:a:ibm:sterling_partner_engagement_manager:6.2.2:*:*:*:*:*:*:*
ibmsterling_partner_engagement_manager62.0cpe:2.3:a:ibm:sterling_partner_engagement_manager:62.0:*:*:*:*:*:*:*
ibmsterling_partner_engagement_manager6.1.2cpe:2.3:a:ibm:sterling_partner_engagement_manager:6.1.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	sterling_partner_engagement_manager	6.2.2	cpe:2.3:a:ibm:sterling_partner_engagement_manager:6.2.2:::::::*
ibm	sterling_partner_engagement_manager	62.0	cpe:2.3:a:ibm:sterling_partner_engagement_manager:62.0:::::::*
ibm	sterling_partner_engagement_manager	6.1.2	cpe:2.3:a:ibm:sterling_partner_engagement_manager:6.1.2:::::::*