CVE-2023-27866

MEDIUM

IBM Informix JDBC Driver 4.10 and 4.50 - Remote Code Execution via JNDI Injection

Title source: llm

Description

IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver do not verify supplied LDAP URL in Connect String. IBM X-Force ID: 249511.

References (2)

Core 2

Core References

Patch, Vendor Advisory vendor-advisory

https://www.ibm.com/support/pages/node/7007615

VDB Entry, Vendor Advisory vdb-entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/249511

Scores

CVSS v3 6.3

EPSS 0.0040

EPSS Percentile 60.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-94

Status published

Products (2)

ibm/informix_jdbc_driver 4.10

ibm/informix_jdbc_driver 4.50.0 - 4.50.10

Published Jun 28, 2023

Tracked Since Feb 18, 2026