Security Bulletin: IBM Tivoli Application Dependency Discovery Manager is vulnerable to a bypass vulnerability due to the use of Python (CVE-2023-24329)

2023-03-2318:06:16

www.ibm.com

ibm tivoli application dependency discovery manager

python vulnerability

cve-2023-24329

security bypass

fixcentral

vulnerability mitigation

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

EPSS

0.002

Percentile

52.1%

JSON

Summary

A publicly disclosed vulnerability in Python affects IBM Tivoli Application Dependency Discovery Manager (CVE-2023-24329)

Vulnerability Details

CVEID:CVE-2023-24329
**DESCRIPTION:**Python could allow a remote attacker to bypass security restrictions, caused by a flaw in the urllib.parse component. By sending a specially-crafted request using URL starts with blank characters, an attacker could exploit this vulnerability to bypass blocklisting methods.
CVSS Base score: 7.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/247730 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Tivoli Application Dependency Discovery Manager	7.3.0.3 -7.3.0.10

Remediation/Fixes

IBM strongly recommends addressing the vulnerability using the efix below published on FixCentral.

Fix	VRMF	APAR	How to acquire fix
efix_jython_CVE-2023-24329_FP10221123.zip	7.3.0.3 -7.3.0.10	NONE	Download eFix

Workarounds and Mitigations

none

Affected configurations

Vulners

Node

ibmtivoli_application_dependency_discovery_managerMatch7.3.0.

VendorProductVersionCPE
ibmtivoli_application_dependency_discovery_manager7.3.0.cpe:2.3:a:ibm:tivoli_application_dependency_discovery_manager:7.3.0.:*:*:*:*:*:*:*