CVE-2023-47741

2023-12-1820:15:08

CWE-522

[email protected]

web.nvd.nist.gov

ibm i

db2 mirror

clear-text passwords

browser memory

exploitation

unauthorized access

CVSS3

5.3

Attack Vector

PHYSICAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

0.001

Percentile

20.7%

JSON

IBM i 7.3, 7.4, 7.5, IBM i Db2 Mirror for i 7.4 and 7.5 web browser clients may leave clear-text passwords in browser memory that can be viewed using common browser tools before the memory is garbage collected. A malicious actor with access to the victim’s PC could exploit this vulnerability to gain access to the IBM i operating system. IBM X-Force ID: 272532.

Affected configurations

Nvd

Node

ibmdb2_mirror_for_iMatch7.4

ibmdb2_mirror_for_iMatch7.5

ibmiMatch7.3

ibmiMatch7.4

ibmiMatch7.5

VendorProductVersionCPE
ibmdb2_mirror_for_i7.4cpe:2.3:a:ibm:db2_mirror_for_i:7.4:*:*:*:*:*:*:*
ibmdb2_mirror_for_i7.5cpe:2.3:a:ibm:db2_mirror_for_i:7.5:*:*:*:*:*:*:*
ibmi7.3cpe:2.3:a:ibm:i:7.3:*:*:*:*:*:*:*
ibmi7.4cpe:2.3:a:ibm:i:7.4:*:*:*:*:*:*:*
ibmi7.5cpe:2.3:a:ibm:i:7.5:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	db2_mirror_for_i	7.4	cpe:2.3:a:ibm:db2_mirror_for_i:7.4:::::::*
ibm	db2_mirror_for_i	7.5	cpe:2.3:a:ibm:db2_mirror_for_i:7.5:::::::*
ibm	i	7.3	cpe:2.3:a:ibm:i:7.3:::::::*
ibm	i	7.4	cpe:2.3:a:ibm:i:7.4:::::::*
ibm	i	7.5	cpe:2.3:a:ibm:i:7.5:::::::*