Main Vulnerability Database SB2022041214

SB2022041214 - Code injection in IBM Cloud APM

Published: April 12, 2022

Security Bulletin ID SB2022041214

Severity

High

Patch available

Number of vulnerabilities 1

Exploitation vector Remote access

Highest impact Data manipulation

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 1 security vulnerability.

1) Code Injection (CVE-ID: CVE-2021-23450)

The disclosed vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote attacker can inject and execute arbitrary script code via the setObject function.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-websphere-application-server-liberty-affects-ibm-performance-management-products-cve-2021-23450/"
https://www.ibm.com/blogs/psirt/security-bulletin-a-vulnerability-in-ibm-websphere-application-server-liberty-affects-ibm-performance-management-products-cve-2021-23450/</a>
https://www.ibm.com/support/pages/node/6571167