CVE-2023-27869

Katalog CVE

CVSS 8.8 · High EPSS 1,6%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada ibm db2. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

IBM Db2 JDBC Driver for Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unchecked logger injection. By sending a specially crafted request using the named traceFile property, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 249517.

Rincian

Terbit di NVD

10 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://exchange.xforce.ibmcloud.com/vulnerabilities/249517 vdb entry · advisory vendor
• https://www.ibm.com/support/pages/node/7010029 patch · advisory vendor
• https://security.netapp.com/advisory/ntap-20230803-0006/