SB2023090633 - Multiple vulnerabilities in IBM Intelligent Operations Center
Published: September 6, 2023
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 4 secuirty vulnerabilities.
1) Resource exhaustion (CVE-ID: CVE-2022-43929)
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to application does not properly control consumption of internal resources when processing input passed to the "Load" command. A local user can trigger resource exhaustion and perform a denial of service (DoS) attack.
2) Improper Privilege Management (CVE-ID: CVE-2022-43927)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to improper privilege management when a specially crafted table access is used.. A remote user can gain access to sensitive information.
3) Improper Certificate Validation (CVE-ID: CVE-2014-3577)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to improper certificate validation. A remote attacker can perform a man-in-the-middle (MitM) attack and spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate.
4) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2022-43930)
The vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to software stores sensitive information into log files. A local user can read the log files and gain access to sensitive data.
Remediation
Install update from vendor's website.