CVE-2023-47746

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.5, 11.1, and 11.5 could allow an authenticated user with CONNECT privileges to cause a denial of service using a specially crafted query. IBM X-Force ID: 272644.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20 CWE-770

Affected software

Vendor	Product	Versions
IBM	Db2 for Linux, UNIX and Windows	10.5, 11.1, 11.5
ibm	db2_for_linux_unix_and_windows	10.5; 11.1; 11.5

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/272644VDB Entry, Vendor Advisory
https://security.netapp.com/advisory/ntap-20240307-0003/
https://www.ibm.com/support/pages/node/7105505Patch, Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/272644VDB Entry, Vendor Advisory
https://security.netapp.com/advisory/ntap-20240307-0003/
https://www.ibm.com/support/pages/node/7105505Patch, Vendor Advisory

Timeline

Published: Jan 22, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-477476.5IBM DB2 for Linux, UNIX and Windows (includes Db2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated user with CONNECT privil CVE-2023-47755.4The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advanced_iframe' shortcode in versions up to,CVE-2023-477549.8Missing Authorization vulnerability in Clever plugins Delete Duplicate Posts allows Accessing Functionality Not Properly Constrained by ACLs CVE-2023-477556.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AazzTech WooCommerce Product Carousel CVE-2023-477564.3Missing Authorization vulnerability in David Vongries Welcome Email Editor allows Exploiting Incorrectly Configured Access Control Security CVE-2023-477578.8Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin CVE-2023-477588.8Cross-Site Request Forgery (CSRF) vulnerability in Mondula GmbH Multi Step Form plugin <= 1.7.11 versions.CVE-2023-477594.8Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Chaty chaty allows DOM-Based XS CVE-2023-47768.8The School Management System WordPress plugin before 2.2.5 uses the WordPress esc_sql() function on a field not delimited by quotes and did CVE-2023-477608.8Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured CVE-2023-477614.3Missing Authorization vulnerability in WPDeveloper Simple 301 Redirects by BetterLinks simple-301-redirects allows Exploiting Incorrectly Co CVE-2023-477624.3Missing Authorization vulnerability in WPDeveloper BetterDocs betterdocs allows Exploiting Incorrectly Configured Access Control Security Le