Vulnerability · Published Mar 7, 2025 · Assigned by ibm

CVE-2023-43052IBM Control Center external service interaction

Medium 5.3

In plain English

A medium-severity security flaw in Control Center from IBM. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 69.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with.

Affected products (as reported)

Vendor	Product	Versions
IBM	Control Center	6.2.1 – through 6.3.1

Weakness: CWE-435 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References

https://www.ibm.com/support/pages/node/7185102 vendor-advisory, patch