CVE-2023-35899

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 259354.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1236

Affected software

Vendor	Product	Versions
IBM	Cloud Pak for Automation	18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, 22.0.2
ibm	cloud_pak_for_business_automation	>= 18.0.0, <= 18.0.2; >= 19.0.1, <= 19.0.3; >= 20.0.1, <= 20.0.3; >= 21.0.1, <= 21.0.1_if008; >= 22.0.2, <= 22.0.2_if005; >= 23.0.1, <= 23.0.1_if001
ibm	cloud_pak_for_business_automation	>= 21.0.3, <= 21.0.3_if023

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/259354Vendor Advisory
https://www.ibm.com/support/pages/node/7030357Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/259354Vendor Advisory
https://www.ibm.com/support/pages/node/7030357Vendor Advisory

Timeline

Published: Mar 21, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-35907.5Mattermost fails to delete card attachments in Boards, allowing an attacker to access deleted attachments.CVE-2023-359005.3IBM Robotic Process Automation for Cloud Pak 21.0.0 through 21.0.7.4 and 23.0.0 through 23.0.5 is vulnerable to disclosing server version in CVE-2023-359015.3IBM Robotic Process Automation 21.0.0 through 21.0.7.6 and 23.0.0 through 23.0.6 is vulnerable to client side validation bypass which could CVE-2023-359055.4IBM FileNet Content Manager 5.5.8, 5.5.10, and 5.5.11 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitr CVE-2023-359067.5IBM Aspera Faspex 5.0.5 could allow a remote attacked to bypass IP restrictions due to improper access controls. IBM X-Force ID: 259649.CVE-2023-359079.8IBM Aspera Faspex 5.0.0 through 5.0.10 does not require that users should have strong passwords by default, which makes it easier for attack CVE-2023-359086.5Apache Airflow, versions before 2.6.3, is affected by a vulnerability that allows unauthorized read access to a DAG through the URL. It is r CVE-2023-359095.3Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress le CVE-2023-35918.2Mattermost fails to invalidate previously generated password reset tokens when a new reset token was created.CVE-2023-359108.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nucleus_genius Quasar form free – Cont CVE-2023-359119.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Creative Solutions Contact Form Genera CVE-2023-359128.8Cross-Site Request Forgery (CSRF) vulnerability in WP Zone Potent Donations for WooCommerce plugin <= 1.1.9 versions.