Security Bulletin: IBM Sterling Global Mailbox is vulnerable to privilege escalation attack due to Apache Cassandra

Summary

Apache Cassandra is used by IBM Global Mailbox as part of the application database.

Vulnerability Details

CVEID:CVE-2023-30601
**DESCRIPTION:**Apache Cassandra could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw in the FQL/Audit logs implementation. By executing a specially crafted nodetool archive command, an attacker could exploit this vulnerability to gain elevated privileges.
CVSS Base score: 7.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/256502 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading

Product and Version(s)

|

Version(s)

|

Remediation

—|—|—

IBM Sterling Global Mailbox

|

6.0, 6.1

| Apply IBM Sterling B2B Integrator fix pack 6.1.2.3. or 6.2.0.0 on Fix Central.

Workarounds and Mitigations

None