Security Bulletin: CICS Transaction Gateway Containers are vulnerable to Unrestricted Internet Access/Outbound Connections (CVE-2023-47140).

Summary

CICS Transaction Gateway Containers are vulnerable to CVE-2023-47140 if proper egress/ingress policies are not configured at either POD or HOST level.

Vulnerability Details

CVEID:CVE-2023-47140
**DESCRIPTION:**IBM CICS Transaction Gateway could allow a user to transfer or view files due to improper access controls.
CVSS Base score: 4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/270259 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

Product

| VRMF|Platforms|Remediation/First Fix
—|—|—|—
CICS Transaction Gateway for Multiplatforms| 9.3.0.0| Linux on IBM Z container |

Threat actors can use exfiltration techniques that enable them to intercept networks which can result in data loss or leakage. Ingress and egress filtering keeps suspicious traffic out of the network. In order to create a Network policy for your CICS Transaction Gateway container, follow these instructions: Restricting network traffic for CICS Transaction Gateway containers

CICS Transaction Gateway for Multiplatforms | 9.3.0.0| Linux on Intel container

Workarounds and Mitigations

None