Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM4B22C13BA0342AC072AE2964609BF8343A0D70A7820D3DD04038EE3A4EED69B1
HistoryJul 24, 2023 - 8:30 p.m.

Security Bulletin: VMware Tanzu Spring Framework is vulnerable to CVE-2023-20861 and CVE-2023-20863 used in IBM Maximo Application Suite - Monitor Component

2023-07-2420:30:30
www.ibm.com
17
ibm maximo application suite
monitor component
vmware tanzu spring framework
vulnerability
cve-2023-20861
cve-2023-20863
denial of service

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.003 Low

EPSS

Percentile

70.0%

JSON

Summary

IBM Maximo Application Suite - Monitor Component uses VMware Tanzu Spring Framework which is vulnerable to CVE-2023-20861 and CVE-2023-20863.

Vulnerability Details

CVEID:CVE-2023-20861
**DESCRIPTION:**VMware Tanzu Spring Framework is vulnerable to a denial of service. By sending a specially crafted SpEL expression, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/250701 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

CVEID:CVE-2023-20863
**DESCRIPTION:**VMware Tanzu Spring Framework is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted SpEL expression, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/252807 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Maximo Application Suite - Monitor Component 8.9
IBM Maximo Application Suite - Monitor Component 8.10

Remediation/Fixes

Affected Product(s) Fixpack Version(s)
IBM Maximo Application Suite - Monitor Component 8.9.6 or latest (available from the Catalog under Update Available)
IBM Maximo Application Suite - Monitor Component 8.10.4 or latest (available from the Catalog under Update Available)

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmmaximo_application_suiteMatch8.9
OR
ibmmaximo_application_suiteMatch8.10

Related

ibm 42
ubuntucve 2
nvd 2
broadcom 2
cve 2
veracode 2
openvas 6
osv 4
github 2
redhatcve 3
prion 2
f5 1
cvelist 2
debiancve 2
nessus 12
spring 1
redhat 10
oracle 4
ibm
ibm
Security Bulletin: IBM Spectrum Symphony with Spring Framework is vulnerable to a denial of service, caused by improper input validation
2023-10-05 20:36:15
Security Bulletin: IBM Spectrum Conductor with Spring Framework is vulnerable to a denial of service
2023-10-05 20:34:38
Security Bulletin: Multiple vulnerabilities in VMware Tanzu Spring Framework affect IBM Process Designer 8.5.7 shipped with IBM Business Automation Workflow
2023-06-05 15:11:24
ubuntucve
ubuntucve
CVE-2023-20863
2023-04-13 00:00:00
CVE-2023-20861
2023-03-23 00:00:00
nvd
nvd
CVE-2023-20863
2023-04-13 20:15:07
CVE-2023-20861
2023-03-23 21:15:19
broadcom
broadcom
Spring Expression DoS Vulnerability (CVE-2023-20863)
2024-04-16 00:00:00
Spring Expression DoS Vulnerability (CVE-2023-20861)
2024-04-16 00:00:00
cve
cve
CVE-2023-20861
2023-03-23 21:15:19
CVE-2023-20863
2023-04-13 20:15:07
veracode
veracode
Denial Of Service (DoS)
2023-04-18 07:02:49
Denial Of Service (DoS)
2023-03-27 22:04:35
openvas
openvas
VMware Spring Framework < 5.2.24, 5.3.x < 5.3.27, 6.0.x < 6.0.8 DoS Vulnerability - Windows
2023-04-14 00:00:00
VMware Spring Framework < 5.2.24, 5.3.x < 5.3.27, 6.0.x < 6.0.8 DoS Vulnerability - Linux
2023-04-14 00:00:00
VMware Spring Framework 5.3.x < 5.3.26, 6.0.x < 6.0.7 Security Bypass Vulnerability - Windows
2023-03-21 00:00:00
osv
osv
CVE-2023-20863
2023-04-13 20:15:07
Spring Framework vulnerable to denial of service via specially crafted SpEL expression
2023-03-23 21:30:19
CVE-2023-20861
2023-03-23 21:15:19
github
github
Spring Framework vulnerable to denial of service
2023-04-13 21:30:27
Spring Framework vulnerable to denial of service via specially crafted SpEL expression
2023-03-23 21:30:19
redhatcve
redhatcve
CVE-2023-20863
2023-04-18 15:31:05
CVE-2023-20861
2023-03-24 13:07:29
CVE-2023-20860
2023-03-24 13:07:33
prion
prion
Race condition
2023-03-23 21:15:00
Race condition
2023-04-13 20:15:00
f5
f5
K000134681 : Spring Framework vulnerability CVE-2023-20861
2023-05-19 00:00:00
cvelist
cvelist
CVE-2023-20861
2023-03-23 00:00:00
CVE-2023-20863
2023-04-13 00:00:00
debiancve
debiancve
CVE-2023-20863
2023-04-13 20:15:07
CVE-2023-20861
2023-03-23 21:15:19
nessus
nessus
Spring Framework < 5.2.23 / 5.3.x < 5.3.26 / 6.0.x < 6.0.7 DoS (CVE-2023-20861)
2023-05-04 00:00:00
RHEL 8 : Red Hat Virtualization (RHSA-2023:3771)
2023-06-22 00:00:00
Oracle Identity Manager (Jul 2023 CPU)
2023-07-21 00:00:00
spring
spring
This Week in Spring - March 21st, 2023
2023-03-21 00:00:00
redhat
redhat
(RHSA-2023:2099) Important: Red Hat Integration Camel for Spring Boot 3.18.3 Patch 1 security update
2023-05-03 14:03:45
(RHSA-2023:3771) Important: Red Hat Virtualization security and bug fix update
2023-06-21 19:50:23
(RHSA-2023:3185) Important: Red Hat AMQ Broker 7.10.3 release and security update
2023-05-17 13:55:59
oracle
oracle
Oracle Critical Patch Update Advisory - October 2023
2023-10-17 00:00:00
Oracle Critical Patch Update Advisory - July 2023
2023-07-18 00:00:00
Oracle Critical Patch Update Advisory - April 2024
2024-04-16 00:00:00

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

0.003 Low

EPSS

Percentile

70.0%

JSON
Related for 4B22C13BA0342AC072AE2964609BF8343A0D70A7820D3DD04038EE3A4EED69B1
ibm42ubuntucve2nvd2broadcom2cve2veracode2openvas6osv4github2redhatcve3prion2f51cvelist2debiancve2nessus12spring1redhat10oracle4