CVE-2023-26280 - Vulnerability Details - OpenCVE

IBM Jazz Foundation 7.0.2 and 7.0.3 could allow a user to change their dashboard using a specially crafted HTTP request due to improper access control.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Ibm	Jazz Foundation

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7176207

History

Mon, 25 Nov 2024 18:30:00 +0000

Type	Values Removed	Values Added
Description	IBM Jazz Foundation 7.0.2 and 7.0.3 could allow a user to change their dashboard using a specially crafted HTTP request due to improper access control.	IBM Jazz Foundation 7.0.2 and 7.0.3 could allow a user to change their dashboard using a specially crafted HTTP request due to improper access control.

Mon, 25 Nov 2024 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 25 Nov 2024 16:00:00 +0000

Type	Values Removed	Values Added
Description		IBM Jazz Foundation 7.0.2 and 7.0.3 could allow a user to change their dashboard using a specially crafted HTTP request due to improper access control.
Title		IBM Jazz Foundation improper access control
First Time appeared		Ibm Ibm jazz Foundation
Weaknesses		CWE-266
CPEs		cpe:2.3:a:ibm:jazz_foundation:7.0.2:::::::* cpe:2.3:a:ibm:jazz_foundation:7.0.3:::::::*
Vendors & Products		Ibm Ibm jazz Foundation
References		https://www.ibm.com/support/pages/node/7176207
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2024-11-25T15:51:46.104Z

Updated: 2024-11-25T18:16:42.402Z

Reserved: 2023-02-21T13:55:50.150Z

Link: CVE-2023-26280

Vulnrichment

Updated: 2024-11-25T16:24:56.305Z

NVD

Status : Received

Published: 2024-11-25T16:15:06.243

Modified: 2024-11-25T19:15:06.987

Link: CVE-2023-26280

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-26280", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2023-02-21T13:55:50.150Z", "datePublished": "2024-11-25T15:51:46.104Z", "dateUpdated": "2024-11-25T18:16:42.402Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:ibm:jazz_foundation:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:jazz_foundation:7.0.3:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Jazz Foundation", "vendor": "IBM", "versions": [{"status": "affected", "version": "7.0.2, 7.0.3"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">IBM Jazz Foundation 7.0.2 and 7.0.3 <span style=\"background-color: rgb(255, 255, 255);\">could allow a user to change their dashboard using a specially crafted HTTP request due to improper access control.</span>\n\n</span>"}], "value": "IBM Jazz Foundation 7.0.2 and 7.0.3\u00a0could allow a user to change their dashboard using a specially crafted HTTP request due to improper access control."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-266", "description": "CWE-266 Incorrect Privilege Assignment", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2024-11-25T18:16:42.402Z"}, "references": [{"url": "https://www.ibm.com/support/pages/node/7176207"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Jazz Foundation improper access control", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-25T16:24:35.601366Z", "id": "CVE-2023-26280", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-25T16:25:00.282Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-26280", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-11-25T16:24:35.601366Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-25T16:24:56.305Z"}}], "cna": {"title": "IBM Jazz Foundation improper access control", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:ibm:jazz_foundation:7.0.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:jazz_foundation:7.0.3:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Jazz Foundation", "versions": [{"status": "affected", "version": "7.0.2, 7.0.3"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.ibm.com/support/pages/node/7176207"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM Jazz Foundation 7.0.2 and 7.0.3\u00a0could allow a user to change their dashboard using a specially crafted HTTP request due to improper access control.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">IBM Jazz Foundation 7.0.2 and 7.0.3 <span style=\"background-color: rgb(255, 255, 255);\">could allow a user to change their dashboard using a specially crafted HTTP request due to improper access control.</span>\n\n</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-266", "description": "CWE-266 Incorrect Privilege Assignment"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2024-11-25T18:16:42.402Z"}}}, "cveMetadata": {"cveId": "CVE-2023-26280", "state": "PUBLISHED", "dateUpdated": "2024-11-25T18:16:42.402Z", "dateReserved": "2023-02-21T13:55:50.150Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2024-11-25T15:51:46.104Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}