Lucene search

K
nvd[email protected]NVD:CVE-2023-27558
HistoryJul 10, 2023 - 4:15 p.m.

CVE-2023-27558

2023-07-1016:15:50
CWE-269
web.nvd.nist.gov
ibm db2
windows
privilege escalation
vulnerability
local attacker
elevated privileges
unquoted service path
x-force id

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

IBM Db2 on Windows 10.5, 11.1, and 11.5 may be vulnerable to a privilege escalation caused by at least one installed service using an unquoted service path. A local attacker could exploit this vulnerability to gain elevated privileges by inserting an executable file in the path of the affected service. IBM X-Force ID: 249194.

Affected configurations

NVD
Node
microsoftwindowsMatch-
AND
ibmdb2Match10.5.0.11
OR
ibmdb2Match11.1.4.7
OR
ibmdb2Match11.5-

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.5 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

Related for NVD:CVE-2023-27558