{"api_version":"1","generated_at":"2026-07-23T22:02:19+00:00","cve":"CVE-2023-27866","urls":{"html":"https://cve.report/CVE-2023-27866","api":"https://cve.report/api/cve/CVE-2023-27866.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2023-27866","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2023-27866"},"summary":{"title":"CVE-2023-27866","description":"IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver do not verify supplied LDAP URL in Connect String.  IBM X-Force ID:  249511.","state":"PUBLIC","assigner":"psirt@us.ibm.com","published_at":"2023-06-28 16:15:00","updated_at":"2023-07-06 18:09:00"},"problem_types":["CWE-94"],"metrics":[],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/249511","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/249511","refsource":"MISC","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.ibm.com/support/pages/node/7007615","name":"https://www.ibm.com/support/pages/node/7007615","refsource":"MISC","tags":[],"title":"Security Bulletin: IBM Informix JDBC Driver Is Vulnerable to Remote Code Execution  (CVE-2023-27866)","mime":"text/html","httpstatus":"200","archivestatus":"404"},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-27866","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27866","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2023","cve_id":"27866","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"informix_jdbc_driver","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2023","cve_id":"27866","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"ibm","cpe5":"informix_jdbc_driver","cpe6":"4.10","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2023-27866","ASSIGNER":"psirt@us.ibm.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when driver code or the application using the driver do not verify supplied LDAP URL in Connect String.  IBM X-Force ID:  249511."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-94 Improper Control of Generation of Code ('Code Injection')","cweId":"CWE-94"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"IBM","product":{"product_data":[{"product_name":"Informix JDBC","version":{"version_data":[{"version_affected":"=","version_value":"4.10, 4.50"}]}}]}}]}},"references":{"reference_data":[{"url":"https://www.ibm.com/support/pages/node/7007615","refsource":"MISC","name":"https://www.ibm.com/support/pages/node/7007615"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/249511","refsource":"MISC","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/249511"}]},"generator":{"engine":"Vulnogram 0.1.0-dev"},"source":{"discovery":"UNKNOWN"},"impact":{"cvss":[{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":6.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","version":"3.1"}]}},"nvd":{"publishedDate":"2023-06-28 16:15:00","lastModifiedDate":"2023-07-06 18:09:00","problem_types":["CWE-94"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL"},"exploitabilityScore":3.9,"impactScore":5.9}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:informix_jdbc_driver:4.10:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:ibm:informix_jdbc_driver:*:*:*:*:*:*:*:*","versionStartIncluding":"4.50.0","versionEndExcluding":"4.50.10","cpe_name":[]}]}]}},"legacy_mitre":{"record":null,"notes":[]}}}