CVE-2023-47152 : IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulner

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5 is vulnerable to an insecure cryptographic algorithm and to information disclosure in stack trace under exceptional conditions.

Published 2024-01-22 20:15:47

Updated 2024-09-27 14:15:04

Source IBM Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2023-47152

IBM » DB2
Versions before (<) 11.5.9
cpe:2.3:a:ibm:db2:*:*:*:*:*:*:*:*
Matching versions
When used together with: IBM » AIX » Version: N/A
When used together with: IBM » Linux On Ibm Z » Version: N/A
When used together with: Linux » Linux Kernel » Version: N/A
When used together with: Microsoft » Windows » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2023-47152

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 13 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-47152

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	3.9	3.6	NIST	2024-01-25
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	2.2	3.6	IBM Corporation	2024-01-22
Attack Vector: Network Attack Complexity: High Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2023-47152

CWE-209 Generation of Error Message Containing Sensitive Information

The product generates an error message that includes sensitive information about its environment, users, or associated data.

Assigned by: psirt@us.ibm.com (Primary)

References for CVE-2023-47152

https://security.netapp.com/advisory/ntap-20240307-0001/

January 2024 IBM DB2 11.5 Vulnerabilities in NetApp Products | NetApp Product Security

CVEs referencing this url
https://www.ibm.com/support/pages/node/7105605

Patch;Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/270730

Vulnerability Report
VDB Entry;Vendor Advisory

Jump to

Vulnerability Details : CVE-2023-47152

Products affected by CVE-2023-47152

Exploit prediction scoring system (EPSS) score for CVE-2023-47152

CVSS scores for CVE-2023-47152

CWE ids for CVE-2023-47152

References for CVE-2023-47152