CVE-2023-43045: IBM Sterling Partner Engagement Manager security bypass

Reference Links

• https://www.ibm.com/support/pages/node/7057409 (Advisory)
• https://exchange.xforce.ibmcloud.com/vulnerabilities/266896

Parent vulnerabilities

(Appears in the following advisories)

• IBM-7057409

Frequently Asked Questions

• What is the vulnerability ID for this security bypass in IBM Sterling Partner Engagement Manager?

  The vulnerability ID for this security bypass is CVE-2023-43045.

• What is the severity rating of CVE-2023-43045?

  The severity rating of CVE-2023-43045 is medium with a score of 5.9.

• Which versions of IBM Sterling Partner Engagement Manager are affected by this vulnerability?

  IBM Sterling Partner Engagement Manager versions 6.1.2, 6.2.0, and 6.2.2 are affected by this vulnerability.

• How can a remote user exploit this vulnerability?

  A remote user can exploit this vulnerability to perform unauthorized actions due to improper authentication.

• Is there a patch available to fix this vulnerability?

  Yes, IBM has provided a patch to fix this vulnerability. You can find the patch at the following URL: [IBM Sterling Partner Engagement Manager Patch](https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=ibm%7EOther%20software&product=ibm/Other+software/IBM+Sterling+Partner+Engagement+Manager+Software&release=6.2.2.1&platform=All&function=fixId&fixids=IBM_PEM_Essentials_6.2.2.1.2&includeSupersedes=0)