Security Bulletin: Unauthenticated Path Traversal security vulnerability CVE-2023-38366 in IBM Content Navigator in FileNet Content Manager

Summary

Unauthenticated Path Traversal security vulnerability CVE-2023-38366 in Administration Console for Content Platform Engine (ACCE)/IBM Content Navigator (ICN) in FileNet Content Manager (FNCM)

Vulnerability Details

CVEID:CVE-2023-38366
**DESCRIPTION:**IBM Content Navigator could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing “dot dot” sequences (/…/) to view arbitrary files on the system.
CVSS Base score: 5.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/261115 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Administration Console for Content Platform Engine (ACCE)/IBM Content Navigator (ICN) security vulnerability in below FileNet Content Manager (FNCM) releases.

Remediation/Fixes

To resolve these vulnerabilities, install one of the patch sets listed below to upgrade to Apache PDFBox v2.0.24 released June 10, 2021.

See the above release readme files and APARs for more information about the fix.

Workarounds and Mitigations

None