SB2022090615 - Multiple vulnerabilities in IBM Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2022090615

SB2022090615 - Multiple vulnerabilities in IBM Content Collector for Email, Content Collector for File Systems, Content Collector for Microsoft SharePoint and Content Collector for IBM Connections

Published: September 6, 2022

Security Bulletin ID SB2022090615
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2021-2369)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error in JAR validation implementation. A remote attacker can modify the signed JAR file in a way it will be considered as signed.


2) Improper input validation (CVE-ID: CVE-2021-2432)

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The vulnerability exists due to improper input validation within the JNDI component in Java SE. A remote non-authenticated attacker can exploit this vulnerability to perform service disruption.


Remediation

Install update from vendor's website.

References