CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
38.6%
There is a vulnerability in Reactor Netty that could allow a remote attacker to traverse directories on the system. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability.
CVEID:CVE-2023-34062
**DESCRIPTION:**VMware Tanzu Reactor Netty could allow a remote attacker to traverse directories on the system, caused by improper validation of user request. An attacker could send a specially crafted URL request containing โdot dotโ sequences (/โฆ/) to view arbitrary files on the system.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/271850 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected Product(s) | Version(s) |
---|---|
IBM Process Mining | 1.13.1, 1.13.2, 1.14.0, 1.14.1, 1.14.2, 1.14.2 IF001 |
Any open source library may be included in one or more sub-components of IBM Process Mining. Open source updates are not always synchronized across all components. The CVE in this bulletin are specifically addressed by
CVE/ X-Force ID | Addressed in component |
---|---|
CVE-2023-34062 | Process Mining |
Product(s) | **Version(s) number and/or range ** | Remediation/Fix/Instructions |
---|---|---|
IBM Process Mining on RedHat OpenShift |
1.13.1, 1.13.2, 1.14.0, 1.14.1, 1.14.2, 1.14.2 IF001
| **Install/Upgrade to version 1.14.3
Installing a Production deployment
**1.To deploy a Production deployment, see installing on
RedHat OpenShift Container Platform environments
**Upgrading an Installation **** **1.To perform an upgrade of a Production deployment, see
upgrading in RedHat OpenShift Container Platform
environments
IBM Process Mining traditional|
1.13.1, 1.13.2, 1.14.0, 1.14.1, 1.14.2
| **Install/Upgrade to version 1.14.3
** 1.Login to PassPortAdvantage
2.Search for
M0GXPML Process Mining 1.14.3 Server Multiplatform
Multilingual
3.Download package
4.Follow install instructions
5.Repeat for M0GXQML Process Mining 1.14.3 Client
Windows Multilingual
None known
Vendor | Product | Version | CPE |
---|---|---|---|
ibm | ibm_process_mining | 1.13.1 | cpe:2.3:a:ibm:ibm_process_mining:1.13.1:*:*:*:*:*:*:* |
ibm | ibm_process_mining | 1.13.2 | cpe:2.3:a:ibm:ibm_process_mining:1.13.2:*:*:*:*:*:*:* |
ibm | ibm_process_mining | 1.14.0 | cpe:2.3:a:ibm:ibm_process_mining:1.14.0:*:*:*:*:*:*:* |
ibm | ibm_process_mining | 1.14.1 | cpe:2.3:a:ibm:ibm_process_mining:1.14.1:*:*:*:*:*:*:* |
ibm | ibm_process_mining | 1.14.2 | cpe:2.3:a:ibm:ibm_process_mining:1.14.2:*:*:*:*:*:*:* |
ibm | ibm_process_mining | 001 | cpe:2.3:a:ibm:ibm_process_mining:001:*:*:*:*:*:*:* |
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
38.6%