IBM Sterling Connect:express For Unix vulnerabilities

4 CVEs affecting IBM Sterling Connect:express For Unix, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-32331, published 2024-03-04.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-32331, published 2024-03-04. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. IBM Connect:Express for UNIX 1.5.0 is vulnerable to a buffer overflow that could allow a remote attacker to cause a denial of service through its browser UI. IBM X-Force ID: 254979.
CVE-2023-29259, published 2023-07-19. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. IBM Sterling Connect:Express for UNIX 1.5 browser UI is vulnerable to attacks that rely on the use of cookies without the SameSite attribute. IBM X-Force ID: 252055.
CVE-2021-38933, published 2023-07-19. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. IBM Sterling Connect:Direct for UNIX 1.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 210574.
CVE-2023-29260, published 2023-07-19. Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days. IBM Sterling Connect:Express for UNIX 1.5 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially…