CVE-2023-40377— IBM i privilege escalation
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2023-40377
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
IBM i privilege escalation
Source: NVD (National Vulnerability Database)
Vulnerability Description
Backup, Recovery, and Media Services (BRMS) for IBM i 7.2, 7.3, and 7.4 contains a local privilege escalation vulnerability. A malicious actor with command line access to the host operating system can elevate privileges to gain component access to the host operating system. IBM X-Force ID: 263583.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
特权管理不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
IBM i 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
IBM i是美国国际商业机器（IBM）公司的一套运行在IBM Power Systems和IBM PureSystems中的操作系统。 IBM i 7.2版本，7.3版本，7.4版本存在安全漏洞，该漏洞源于存在本地权限提升漏洞。攻击者可利用该漏洞提升权限并获得对主机操作体系的组件访问权。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-40377
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-40377
请登录查看更多情报信息。
- https://www.ibm.com/support/pages/node/7048121vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2023-40377
Same Patch Batch · IBM · 2023-10-16 · 12 CVEs total
| CVE-2023-38280 | 8.4 HIGH | IBM Power HMC privilege escalation |
| CVE-2023-30991 | 7.5 HIGH | IBM Db2 denial of service |
| CVE-2023-40373 | 5.3 MEDIUM | IBM Db2 denial of service |
| CVE-2023-40372 | 5.3 MEDIUM | IBM Db2 denial of service |
| CVE-2023-40374 | 5.3 MEDIUM | IBM Db2 denial of service |
| CVE-2023-38728 | 5.3 MEDIUM | IBM Db2 denial of service |
| CVE-2023-38740 | 5.3 MEDIUM | IBM Db2 denial of service |
| CVE-2023-38720 | 5.3 MEDIUM | IBM Db2 denial of service |
| CVE-2023-30987 | 5.3 MEDIUM | IBM Db2 denial of service |
| CVE-2023-33836 | 5.3 MEDIUM | IBM Security Verify Governance information disclosure |
| CVE-2023-38719 | 5.1 MEDIUM | IBM Db2 denial of service |
IV. Related Vulnerabilities
Same vendor: IBM
- CVE-2026-1577
IBM® Db2® is vulnerable to a denial of service with a specia - CVE-2025-36122
IBM® Db2® is vulnerable to a denial of service with a specia - CVE-2025-14688
IBM® Db2® is vulnerable to a denial of service when fetching - CVE-2026-2311
IBM i is affected by a privilege escalation vulnerability in - CVE-2025-36180
Inadequate Pod Communication Restrictions, affects watsonx.d
Same weakness: CWE-269
- CVE-2026-42562
Plainpad: Privilege Escalation via Writable Admin Field in P - CVE-2026-41163
bubblewrap vulnerable to privilege escalation in setuid mode - CVE-2026-44987
SysReptor: Privilege Escalation from User Admin to Superuser - CVE-2026-42185
People: Privilege Escalation via Missing Role Ceiling in Mai - CVE-2026-40001
Local privilege escalation vulnerability in ZTE PROCESS Guar
V. Comments for CVE-2023-40377
No comments yet