CVE-2023-43052
Ibm Control Center 6.2.1.0 … 6.3.1.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NSummary
CVE-2023-43052 is a medium-severity Improper Interaction Between Multiple Correctly-Behaving Entities (CWE-435) vulnerability in Ibm Control Center. Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-47473
Vulnerability Data
IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests…
more
to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.2.1V3.3.3V10.5.5V13.2.6
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement structurally constrains how entities exchange data and thus can stop emergent incorrect behaviors at integration points.
Developer testing and evaluation can discover interaction defects that only appear when components are integrated.
Requiring an explicit security architecture and design forces analysis and mitigation of interaction failures between components before integration.
Partitioning the system into separate domains reduces the surface on which correct individual behaviors can combine into incorrect system-level behavior.
Preventing unauthorized or unintended information transfer through shared resources directly blocks one common class of improper inter-entity interaction.
Security engineering principles such as separation of domains and least privilege directly reduce the chance that individually correct components produce incorrect joint behavior.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Correlating logs and events from multiple independent entities directly surfaces interaction-induced misbehavior.
Security tests and exercises that include third-party components explicitly exercise cross-entity interactions.
Secure SDLC practices encompass integration and interface testing that can prevent interaction errors.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles address component interfaces and composition risks.
Security testing during integration and acceptance can reveal interaction-induced weaknesses.
Project-level integration planning can surface interaction issues between components.
Secure SDLC practices include integration and interface testing that can detect interaction flaws.
Explicit application security requirements can specify expected component interactions.
Change management can require impact analysis of component interactions before deployment.