Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBMF618513A0299843E3A2C32A691F54D696830783260950C529C9E0759FEE47F7A
HistoryDec 01, 2023 - 7:30 p.m.

Security Bulletin: Babel-traverse is vulnerable to CVE-2023-45133 used in IBM Maximo Application Suite - Monitor Component

2023-12-0119:30:36
www.ibm.com
9
ibm maximo
babel-traverse
cve-2023-45133
vulnerability
fixpack
update available

9.3 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.8%

JSON

Summary

IBM Maximo Application Suite - Monitor Component uses babel-traverse which is vulnerable to CVE-2023-45133. This bulletin identifies the steps to take to address the vulnerability.

Vulnerability Details

CVEID:CVE-2023-45133
**DESCRIPTION:**Babel could allow a local attacker to execute arbitrary code on the system, caused by a flaw in the path.evaluate()or path.evaluateTruthy(). By using a specially crafted code to compile, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 8.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/268647 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Maximo Application Suite - Monitor Component 8.11
IBM Maximo Application Suite - Monitor Component 8.10

Remediation/Fixes

Affected Product(s) Fixpack Version(s)
IBM Maximo Application Suite - Monitor Component 8.11.1 or latest (available from the Catalog under Update Available)
IBM Maximo Application Suite - Monitor Component 8.10.6 or latest (available from the Catalog under Update Available)

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmmaximo_application_suiteMatch8.11
OR
ibmmaximo_application_suiteMatch8.10

Related

osv 4
prion 1
nessus 2
veracode 1
redhatcve 1
ibm 19
cve 1
debian 2
openvas 2
nvd 1
github 1
debiancve 1
ubuntucve 1
cvelist 1
osv
osv
node-babel - security update
2023-10-14 00:00:00
node-babel7 - security update
2023-10-16 00:00:00
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
2023-10-16 13:55:36
prion
prion
Code injection
2023-10-12 17:15:00
nessus
nessus
Debian DSA-5528-1 : node-babel7 - security update
2023-10-17 00:00:00
Debian DLA-3618-1 : node-babel - LTS security update
2023-10-20 00:00:00
veracode
veracode
Arbitrary Code Execution
2023-10-13 09:29:48
redhatcve
redhatcve
CVE-2023-45133
2023-10-19 21:28:41
ibm
ibm
Security Bulletin: IBM Maximo Application Suite uses traverse-7.20.13.tgz which is vulnerable to CVE-2023-45133
2024-02-19 11:15:12
Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Babel
2023-11-29 14:48:17
Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to arbitrary code execution due to Babel.
2024-01-15 11:45:19
cve
cve
CVE-2023-45133
2023-10-12 17:15:09
debian
debian
[SECURITY] [DSA 5528-1] node-babel7 security update
2023-10-16 17:14:32
[SECURITY] [DLA 3618-1] node-babel security update
2023-10-19 07:07:43
openvas
openvas
Debian: Security Advisory (DSA-5528-1)
2023-10-17 00:00:00
Debian: Security Advisory (DLA-3618-1)
2023-10-20 00:00:00
nvd
nvd
CVE-2023-45133
2023-10-12 17:15:09
github
github
Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
2023-10-16 13:55:36
debiancve
debiancve
CVE-2023-45133
2023-10-12 17:15:09
ubuntucve
ubuntucve
CVE-2023-45133
2023-10-12 00:00:00
cvelist
cvelist
CVE-2023-45133 Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code
2023-10-12 16:17:08

9.3 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.6 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.8%

JSON
Related for F618513A0299843E3A2C32A691F54D696830783260950C529C9E0759FEE47F7A
osv4prion1nessus2veracode1redhatcve1ibm19cve1debian2openvas2nvd1github1debiancve1ubuntucve1cvelist1