CVE-2023-43045

CWE-288CWE-306 — Missing Authentication4 documents4 sources
Severity
7.5HIGH
EPSS
0.0%
top 91.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
IBM Sterling Partner Engagement Manager
Timeline
PublishedOct 23

Description

IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.2 could allow a remote user to perform unauthorized actions due to improper authentication. IBM X-Force ID: 266896.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 2.2 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5ibm/sterling_partner_engagement_manager6.1.2, 6.2.0, 6.2.2
▶NVDibm/sterling_partner_engagement_manager6.1.2, 6.2.0, 6.2.2+2

Patches

Patch: www.ibm.com ↗Patch: www.ibm.com ↗

🔴Vulnerability Details

2
CVEList
IBM Sterling Partner Engagement Manager security bypass↗2023-10-23
▶
GHSA
GHSA-vxwp-6hpw-p9g4: IBM Sterling Partner Engagement Manager 6↗2023-10-23
▶

📋Vendor Advisories

1
Oracle
Oracle Oracle Analytics Risk Matrix: Analytics Server (Apache Avro) — CVE-2021-43045↗2023-10-15
▶
CVE-2023-43045 (HIGH CVSS 7.5) | IBM Sterling Partner Engagement Man | cvebase.io