CVE-2023-50316
Published: 28 January 2025
Summary
CVE-2023-50316 is a medium-severity SQL Injection (CWE-89) vulnerability in Ibm Sterling B2B Integrator. Its CVSS base score is 6.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2023-50316 is a SQL injection vulnerability (CWE-89) in IBM Sterling B2B Integrator versions 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1. Published on 2025-01-28, it carries a CVSS v3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). The flaw enables a remote attacker to send specially crafted SQL statements that interact with the back-end database.
A remote attacker with low privileges (PR:L) can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation grants the ability to view, add, modify, or delete information in the back-end database, potentially compromising data integrity and confidentiality.
IBM has published a security advisory at https://www.ibm.com/support/pages/node/7176072 with details on the vulnerability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-55121
Vulnerability details
IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.5 and 6.2.0.0 through 6.2.0.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end…
more
database.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in network-accessible IBM Sterling B2B Integrator directly enables remote exploitation of a public-facing application for unauthorized database read/write/delete operations.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents SQL injection attacks like CVE-2023-50316 by validating and sanitizing all user inputs before processing by the back-end database.
Addresses the root cause of CVE-2023-50316 by requiring timely identification, testing, and deployment of patches for the specific SQL injection flaw in IBM Sterling B2B Integrator.
Supports mitigation of CVE-2023-50316 by restricting input types, formats, and lengths to block specially crafted SQL statements.