Vulnerability-Lookup

CNVD-2025-05561

Vulnerability from cnvd - Published: 2025-03-20

Title

IBM InfoSphere Information Server和IBM InfoSphere DataStage Flow Designer未明漏洞（CNVD-2025-05561）

Description

IBM InfoSphere Information Server和IBM InfoSphere DataStage Flow Designer都是美国国际商业机器（IBM）公司的产品。IBM InfoSphere Information Server是一套数据整合平台。该平台可用于整合各种渠道获取的数据信息。IBM InfoSphere DataStage Flow Designer是一个基于Web的数据阶段流程设计器。 IBM InfoSphere Information Server的IBM InfoSphere DataStage Flow Designer存在未明漏洞。攻击者可利用该漏洞获取敏感信息。

Severity

低

Patch Name

IBM InfoSphere Information Server和IBM InfoSphere DataStage Flow Designer安全漏洞的补丁

Patch Description

IBM InfoSphere Information Server和IBM InfoSphere DataStage Flow Designer都是美国国际商业机器（IBM）公司的产品。IBM InfoSphere Information Server是一套数据整合平台。该平台可用于整合各种渠道获取的数据信息。IBM InfoSphere DataStage Flow Designer是一个基于Web的数据阶段流程设计器。 IBM InfoSphere Information Server的IBM InfoSphere DataStage Flow Designer存在安全漏洞。攻击者可利用该漏洞获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，详情请关注厂商主页： https://www.ibm.com/support/pages/node/6988167

Reference

https://nvd.nist.gov/vuln/detail/CVE-2023-23472

Impacted products

Name
IBM InfoSphere Information Server 11.7

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2023-23472",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2023-23472"
    }
  },
  "description": "IBM InfoSphere Information Server\u548cIBM InfoSphere DataStage Flow Designer\u90fd\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002IBM InfoSphere Information Server\u662f\u4e00\u5957\u6570\u636e\u6574\u5408\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u53ef\u7528\u4e8e\u6574\u5408\u5404\u79cd\u6e20\u9053\u83b7\u53d6\u7684\u6570\u636e\u4fe1\u606f\u3002IBM InfoSphere DataStage Flow Designer\u662f\u4e00\u4e2a\u57fa\u4e8eWeb\u7684\u6570\u636e\u9636\u6bb5\u6d41\u7a0b\u8bbe\u8ba1\u5668\u3002\n\nIBM InfoSphere Information Server\u7684IBM InfoSphere DataStage Flow Designer\u5b58\u5728\u672a\u660e\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttps://www.ibm.com/support/pages/node/6988167",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2025-05561",
  "openTime": "2025-03-20",
  "patchDescription": "IBM InfoSphere Information Server\u548cIBM InfoSphere DataStage Flow Designer\u90fd\u662f\u7f8e\u56fd\u56fd\u9645\u5546\u4e1a\u673a\u5668\uff08IBM\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002IBM InfoSphere Information Server\u662f\u4e00\u5957\u6570\u636e\u6574\u5408\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u53ef\u7528\u4e8e\u6574\u5408\u5404\u79cd\u6e20\u9053\u83b7\u53d6\u7684\u6570\u636e\u4fe1\u606f\u3002IBM InfoSphere DataStage Flow Designer\u662f\u4e00\u4e2a\u57fa\u4e8eWeb\u7684\u6570\u636e\u9636\u6bb5\u6d41\u7a0b\u8bbe\u8ba1\u5668\u3002\r\n\r\nIBM InfoSphere Information Server\u7684IBM InfoSphere DataStage Flow Designer\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "IBM InfoSphere Information Server\u548cIBM InfoSphere DataStage Flow Designer\u5b89\u5168\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "IBM InfoSphere Information Server 11.7"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2023-23472",
  "serverity": "\u4f4e",
  "submitTime": "2025-03-19",
  "title": "IBM InfoSphere Information Server\u548cIBM InfoSphere DataStage Flow Designer\u672a\u660e\u6f0f\u6d1e\uff08CNVD-2025-05561\uff09"
}

CVE-2023-23472 (GCVE-0-2023-23472)

Vulnerability from cvelistv5 – Published: 2024-12-11 12:14 – Updated: 2024-12-11 14:43

Title

IBM InfoSphere Information Server information disclosure

Summary

IBM InfoSphere DataStage Flow Designer (InfoSphere Information Server 11.7) could allow an authenticated user to obtain sensitive information that could aid in further attacks against the system.

Severity ?

3.1 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

CWE

CWE-497 - Exposure of System Data to an Unauthorized Control Sphere

Assigner

ibm

References

URL

Tags

https://www.ibm.com/support/pages/node/6988167

vendor-advisory

Impacted products

	Vendor	Product	Version
	IBM	InfoSphere Information Server	Affected: 11.7 cpe:2.3:a:ibm:infosphere_information_server:11.7:::::::*

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-23472",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-11T14:43:37.611354Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-11T14:43:47.950Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:ibm:infosphere_information_server:11.7:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "InfoSphere Information Server",
          "vendor": "IBM",
          "versions": [
            {
              "status": "affected",
              "version": "11.7"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIBM InfoSphere DataStage Flow Designer (InfoSphere Information Server 11.7) could allow an authenticated user to obtain sensitive information that could aid in further attacks against the system.\u003c/span\u003e"
            }
          ],
          "value": "IBM InfoSphere DataStage Flow Designer (InfoSphere Information Server 11.7) could allow an authenticated user to obtain sensitive information that could aid in further attacks against the system."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.1,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-497",
              "description": "CWE-497 Exposure of System Data to an Unauthorized Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-11T12:14:54.975Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://www.ibm.com/support/pages/node/6988167"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "IBM InfoSphere Information Server information disclosure",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2023-23472",
    "datePublished": "2024-12-11T12:14:54.975Z",
    "dateReserved": "2023-01-12T16:24:46.603Z",
    "dateUpdated": "2024-12-11T14:43:47.950Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2025-05561

CVE-2023-23472 (GCVE-0-2023-23472)

Tags

Sightings

Nomenclature