CVE-2023-27877: IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosure
First published: Thu Jun 29 2023(Updated: )
IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB server and collect sensitive information from the database. IBM X-Force ID: 247905.
Credit: psirt@us.ibm.com psirt@us.ibm.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| IBM Cloud Pak for Data | =4.0 | |
| <=4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2023-27877?
The severity of CVE-2023-27877 is high.
How does CVE-2023-27877 affect IBM Planning Analytics Cartridge for Cloud Pak for Data?
CVE-2023-27877 allows an attacker to obtain sensitive information from the database connected to IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0.
What is the vulnerability ID for this security issue in IBM Planning Analytics Cartridge for Cloud Pak for Data?
The vulnerability ID for this security issue in IBM Planning Analytics Cartridge for Cloud Pak for Data is CVE-2023-27877.
How can an attacker exploit CVE-2023-27877?
An attacker can exploit CVE-2023-27877 by exploiting an insecure password policy to the CouchDB server and collecting sensitive information from the database.
How can I fix CVE-2023-27877 in IBM Planning Analytics Cartridge for Cloud Pak for Data?
To fix CVE-2023-27877 in IBM Planning Analytics Cartridge for Cloud Pak for Data, update to a version that addresses the insecure password policy.
- collector/nvd-latest
- collector/nvd-index
- agent/author
- agent/type
- agent/first-publish-date
- collector/nvd-api
- agent/software-canonical-lookup-request
- agent/remedy
- agent/references
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/event
- collector/ibm-support
- source/IBM
- agent/software-canonical-lookup
- vendor/ibm
- canonical/ibm cloud pak for data
- version/ibm cloud pak for data/4.0
- canonical/ibm planning analytics cartridge for ibm cloud pak for data
- version/ibm planning analytics cartridge for ibm cloud pak for data/4.0