Security Bulletin: IBM Watson Explorer is affected by vulnerabilities in Spring Framework

Summary

IBM Watson Explorer contains a vulnerable version of Spring Framework.

Vulnerability Details

CVEID:CVE-2023-20863
**DESCRIPTION:**VMware Tanzu Spring Framework is vulnerable to a denial of service, caused by improper input validation. By sending a specially crafted SpEL expression, a remote attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/252807 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

CVEID:CVE-2023-20861
**DESCRIPTION:**VMware Tanzu Spring Framework is vulnerable to a denial of service. By sending a specially crafted SpEL expression, a remote attacker could exploit this vulnerability to cause a denial of service.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/250701 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Affected Products and Versions

12.0.0,

12.0.1,

12.0.2.0 - 12.0.2.2, 12.0.3.0 - 12.0.3.11

IBM Watson Explorer
Foundational Components| 11.0.0.0 - 11.0.0.3,
11.0.1,
11.0.2.0 - 11.0.2.15

Remediation/Fixes

12.0.0.0,

12.0.1,

12.0.2.0 - 12.0.2.2, 12.0.3.0 - 12.0.3.11

|

Upgrade to Version 12.0.3.12.

See Watson Explorer Version 12.0.3.12 Foundational Components for download information and instructions.

IBM Watson Explorer
Foundational Components| 11.0.0.0 - 11.0.0.3,
11.0.1,
11.0.2.0 -
11.0.2.15|

Upgrade to Version 11.0.2.16.

See Watson Explorer Version 11.0.2.16 Foundational Components for download information and instructions.

Workarounds and Mitigations

None