by Kastro
Paper/Archive/CVE-2023-35899

CVE-2023-35899

IBM Cloud Pak for Automation — IBM Cloud Pak for Automation CSV injection

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.6.556 × 2011.1No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 259354.

Affected

ProductAffectedFixed inSource
Cloud Pak for Automation18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2–CNA
cloud_pak_for_business_automation18.0.0 – 18.0.2–CISA-ADP
cloud_pak_for_business_automation19.0.1 – 19.0.3–CISA-ADP
cloud_pak_for_business_automation20.0.1 – 20.0.3–CISA-ADP
cloud_pak_for_business_automation21.0.1 – 21.0.1_if008–CISA-ADP
cloud_pak_for_business_automation22.0.2 – 22.0.2_if005–CISA-ADP
cloud_pak_for_business_automation23.0.1 – 23.0.1_if001–CISA-ADP
cloud_pak_for_business_automation21.0.3 – 21.0.3_if023–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ibm (CNA)7.0CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryibm.com/support/pages/node/7030357refexchange.xforce.ibmcloud.com/vulnerabilities/259354