CVE-2023-40683: IBM OpenPages with Watson privilege escalation
IBM OpenPages could allow remote attacker to bypass security restrictions, caused by insufficient authorization checks. By authenticating as an OpenPages user and using non-public APIs, an attacker could exploit this vulnerability to bypass security and gain unauthorized administrative access to the application.
Other sources
IBM OpenPages with Watson 8.3 and 9.0 could allow remote attacker to bypass security restrictions, caused by insufficient authorization checks. By authenticating as an OpenPages user and using non-public APIs, an attacker could exploit this vulnerability to bypass security and gain unauthorized administrative access to the application. IBM X-Force ID: 264005.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2023-40683?
CVE-2023-40683 has been classified as a critical vulnerability due to its potential for remote exploitation and unauthorized access.
How do I fix CVE-2023-40683?
To address CVE-2023-40683, apply the recommended patches provided by IBM for affected versions of OpenPages with Watson.
Which versions of IBM OpenPages with Watson are affected by CVE-2023-40683?
CVE-2023-40683 affects IBM OpenPages with Watson versions up to 9.0 and 8.3, including certain specific build versions.
Can CVE-2023-40683 be exploited remotely?
Yes, CVE-2023-40683 can be exploited remotely by authenticated users leveraging non-public APIs to bypass security restrictions.
What are the consequences of exploiting CVE-2023-40683?
Exploiting CVE-2023-40683 could allow an attacker to gain unauthorized administrative access and compromise the integrity of the system.