CVE-2023-43052
Ibm Control Center 6.2.1.0 … 6.3.1.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-43052 is a medium-severity Improper Interaction Between Multiple Correctly-Behaving Entities (CWE-435) vulnerability in Ibm Control Center. Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-47473
Vulnerability Data
IBM Control Center 6.2.1 through 6.3.1 is vulnerable to an external service interaction attack, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability to induce the application to perform server-side DNS lookups or HTTP requests…
more
to arbitrary domain names. By submitting suitable payloads, an attacker can cause the application server to attack other systems that it can interact with.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement structurally constrains how entities exchange data and thus can stop emergent incorrect behaviors at integration points.
Developer testing and evaluation can discover interaction defects that only appear when components are integrated.
Requiring an explicit security architecture and design forces analysis and mitigation of interaction failures between components before integration.
Partitioning the system into separate domains reduces the surface on which correct individual behaviors can combine into incorrect system-level behavior.
Preventing unauthorized or unintended information transfer through shared resources directly blocks one common class of improper inter-entity interaction.
Security engineering principles such as separation of domains and least privilege directly reduce the chance that individually correct components produce incorrect joint behavior.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Project-level integration planning can surface interaction issues between components.
Secure SDLC practices include integration and interface testing that can detect interaction flaws.
A.8.26 only requires that interaction-related security requirements (e.g. trust, integrity, non-repudiation) be identified and specified during development or acquisition; it does not itself enforce, implement or assure those requirements, so the improper-interaction weakness can still be present and exploitable.
A.8.27 mandates security-by-design principles (defense-in-depth, least privilege, assume-breach, distrust-external-input, fail-securely, integrated controls) plus explicit design reviews against known attack patterns; these directly stop most integration errors between correct components from becoming exploitable weaknesses, with a bounded remainder (rare subtle interaction cases that still slip through even rigorous reviews).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-435, a pillar-level weakness, and none of its children carries one either.