Main Vulnerability Database SB2022031011

SB2022031011 - IBM Cloud Application Business Insights update for dojo

Published: March 10, 2022

Security Bulletin ID SB2022031011

Severity

High

Patch available

YES

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 security vulnerability.

1) Code Injection (CVE-ID: CVE-2021-23450)

The disclosed vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can inject and execute arbitrary script code via the setObject function.

Remediation

Install update from vendor's website.

References

https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ibm-websphere-application-server-liberty-affects-ibm-cloud-application-business-insights-cve-2021-23450/"
https://www.ibm.com/blogs/psirt/security-bulletin-vulnerabilities-in-ibm-websphere-application-server-liberty-affects-ibm-cloud-application-business-insights-cve-2021-23450/</a>
https://www.ibm.com/support/pages/node/6562139