What is CVE-2023-27866?

CVE-2023-27866 is a medium-severity vulnerability in IBM Informix Jdbc, classified under Code Injection. CVSS score: 6.3/10. Published 2023-06-28.

How severe is CVE-2023-27866?

Medium severity. CVSS v3 base score is 6.3 out of 10.

RCE in IBM Informix Jdbc

CVE-2023-27866

IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver do not verify supplied LDAP URL in Connect String. IBM X-Force ID: 249511.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.010 (60.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L.

Affected products

Ibm Informix Jdbc — versions 4.10, 4.50
Ibm Informix_jdbc_driver — versions 4.10

Weakness classification (CWE)

CWE-94 — Code Injection

References

psirt@us.ibm.com (vendor-advisory, Patch, Vendor Advisory)
psirt@us.ibm.com (VDB Entry, vdb-entry, Vendor Advisory)

Frequently asked questions

What is CVE-2023-27866?: CVE-2023-27866 is a medium-severity vulnerability in IBM Informix Jdbc, classified under Code Injection. CVSS score: 6.3/10. Published 2023-06-28.
How severe is CVE-2023-27866?: Medium severity. CVSS v3 base score is 6.3 out of 10.