IBM Control Center up to 6.3.1 improper interaction between multiple correctly-behaving entities

Summaryinfo

A vulnerability marked as problematic has been reported in IBM Control Center up to 6.3.1. Affected by this issue is some unknown functionality. This manipulation causes improper interaction between multiple correctly-behaving entities. This vulnerability is handled as CVE-2023-43052. The attack can be initiated remotely. There is not any exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in IBM Control Center up to 6.3.1. Affected by this vulnerability is an unknown code. The manipulation with an unknown input leads to a improper interaction between multiple correctly-behaving entities vulnerability. The CWE definition for the vulnerability is CWE-435. An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses. As an impact it is known to affect integrity. The summary by CVE is:

IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with.

The advisory is shared at ibm.com. This vulnerability is known as CVE-2023-43052 since 09/15/2023. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/17/2025).

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-47473). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• IBM

Name

• Control Center

Version

• 6.3.0
• 6.3.1

License

• commercial

Website

• Vendor: https://www.ibm.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion