CVE-2023-33854

IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow an authenticated user to bypass client-side validation and manipulate input data using man in the middle techniques.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.ibm.com/support/pages/node/7277112	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:db2::::::::
	cpe:2.3:a:ibm:db2_warehouse::::::::

cpe:2.3:a:ibm:cloud_pak_for_data:-:*:*:*:*:*:*:*

History

26 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) IBM Db2 on Cloud Pak for Data y Db2 Warehouse on Cloud Pak for Data versiones 4.8, 5.0, 5.1, 5.2 y 5.3 podrían permitir a un usuario autenticado eludir la validación del lado del cliente y manipular los datos de entrada utilizando técnicas de hombre en el medio.

Information

Published : 2026-06-22 16:16

Updated : 2026-09-26 23:10

NVD link : CVE-2023-33854

Mitre link : CVE-2023-33854

CVE.ORG link : CVE-2023-33854

JSON object : View

Products Affected

ibm

db2
cloud_pak_for_data
db2_warehouse

CWE

CWE-294

Authentication Bypass by Capture-replay

{"id": "CVE-2023-33854", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2023-33854", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-23T13:41:25.316058Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "psirt@us.ibm.com", "affectedData": [{"cpes": ["cpe:2.3:a:ibm:db2_on_cloud_pak_for_data:4.8:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:db2_on_cloud_pak_for_data:5.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:db2_on_cloud_pak_for_data:5.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:db2_on_cloud_pak_for_data:5.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:db2_on_cloud_pak_for_data:5.3:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:db2_warehouse_on_cloud_pak_for_data:4.8:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:db2_warehouse_on_cloud_pak_for_data:5.0:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:db2_warehouse_on_cloud_pak_for_data:5.1:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:db2_warehouse_on_cloud_pak_for_data:5.2:*:*:*:*:*:*:*", "cpe:2.3:a:ibm:db2_warehouse_on_cloud_pak_for_data:5.3:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data", "versions": [{"status": "affected", "version": "4.8.0", "versionType": "semver", "lessThanOrEqual": "1.8.4"}, {"status": "affected", "version": "5.0.0", "versionType": "semver", "lessThanOrEqual": "5.3.0"}]}]}], "published": "2026-06-22T16:16:31.797", "references": [{"url": "https://www.ibm.com/support/pages/node/7277112", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@us.ibm.com", "description": [{"lang": "en", "value": "CWE-294"}]}], "descriptions": [{"lang": "en", "value": "IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, and 5.3 could allow an authenticated user to bypass client-side validation and manipulate input data using man in the middle techniques."}, {"lang": "es", "value": "IBM Db2 on Cloud Pak for Data y Db2 Warehouse on Cloud Pak for Data versiones 4.8, 5.0, 5.1, 5.2 y 5.3 podr\u00edan permitir a un usuario autenticado eludir la validaci\u00f3n del lado del cliente y manipular los datos de entrada utilizando t\u00e9cnicas de hombre en el medio."}], "lastModified": "2026-09-26T23:10:00.127", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:db2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A74224A4-1534-4746-9F99-8913DE8BB639", "versionEndExcluding": "5.4", "versionStartIncluding": "4.8"}, {"criteria": "cpe:2.3:a:ibm:db2_warehouse:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0CBC8B85-7819-4443-9B5C-EE3282BCD689", "versionEndExcluding": "5.4", "versionStartIncluding": "4.8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:cloud_pak_for_data:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CEF8080B-A664-47DE-A637-965725C7E8BF"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}