CVE-2023-47142
📋 TL;DR
This vulnerability in IBM Tivoli Application Dependency Discovery Manager allows attackers on the local network to escalate privileges through unauthorized API access. Attackers could gain administrative control over the system. Organizations running affected versions of TADDM are at risk.
💻 Affected Systems
- IBM Tivoli Application Dependency Discovery Manager
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where attacker gains administrative privileges, accesses sensitive discovery data, and potentially pivots to other systems.
Likely Case
Privilege escalation leading to unauthorized access to application dependency data and system configuration.
If Mitigated
Limited impact if network segmentation restricts local network access and proper authentication controls are in place.
🎯 Exploit Status
Exploitation requires network access but appears to be straightforward based on the CWE-863 (Incorrect Authorization) classification.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.3.0.11 or later
Vendor Advisory: https://www.ibm.com/support/pages/node/7105139
Restart Required: Yes
Instructions:
1. Download the fix from IBM Fix Central. 2. Apply the fix following IBM's installation instructions. 3. Restart the TADDM services. 4. Verify the fix by checking the version.
🔧 Temporary Workarounds
Network Segmentation
allRestrict network access to TADDM to only authorized management systems and administrators.
Use firewall rules to limit access to TADDM ports (typically 9443, 9080, 9081)
Access Control Lists
allImplement strict network ACLs to limit which systems can communicate with TADDM.
Configure network devices to allow only specific IP ranges to access TADDM
🧯 If You Can't Patch
- Implement strict network segmentation to isolate TADDM from general user networks
- Monitor TADDM API access logs for unauthorized privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check the TADDM version via the web interface or by examining installation files. Versions 7.3.0.0 through 7.3.0.10 are vulnerable.Check Version:
Check the TADDM web interface at https://<server>:9443/taddm or examine the product version in installation directories.Verify Fix Applied:
Verify the version is 7.3.0.11 or later and test API authorization controls.📡 Detection & Monitoring
Log Indicators:
- Unauthorized API calls, privilege escalation attempts, unexpected administrative actions
Network Indicators:
- Unusual API traffic patterns, connections from unexpected internal IPs
SIEM Query:
source="taddm" AND (event_type="api_call" AND user_privilege_change="true")