CVE-2023-23487 : IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 is vulnerable to insufficient audit logging. IBM X-Force ID: 245918.

Published 2023-07-10 16:15:49

Updated 2023-07-31 19:15:16

Source IBM Corporation

View at NVD, CVE.org

Products affected by CVE-2023-23487

EPSS FAQ

0.06%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 26 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None
4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	2.8	1.4	IBM Corporation
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

https://security.netapp.com/advisory/ntap-20230731-0007/

July 2023 IBM DB2 Vulnerabilities in NetApp Products | NetApp Product Security

CVEs referencing this url
https://exchange.xforce.ibmcloud.com/vulnerabilities/245918

IBM Db2 audit logging CVE-2023-23487 Vulnerability Report
VDB Entry;Vendor Advisory
https://www.ibm.com/support/pages/node/7010567

Security Bulletin: IBM® Db2® is vulnerable to insufficient audit logging. (CVE-2023-23487)
Patch;Vendor Advisory

Jump to