CVE-2021-39016 Denial of service in Engineering Lifecycle Optimization Publishing

Medium 4.3 Published 14 Jul 2022 Updated 17 Sep 2024

An attacker can cause the software to transmit excessive network traffic, leading to a denial of service condition.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-39016?

CVE-2021-39016 is a medium-severity denial of service vulnerability in IBM Engineering Lifecycle Optimization Publishing, published on 14 Jul 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

IBM Engineering Lifecycle Optimization - Publishing 6.0.6, 6.0.6.1, 7.0, 7.0.1, and 7.0.2 does not sufficiently monitor or control transmitted network traffic volume, so that an actor can cause the software to transmit more traffic than should be allowed for that actor. IBM X-Force ID: 213722.

Which versions are affected by CVE-2021-39016?

It affects 2 products.

Products include Ibm Engineering Lifecycle Optimization - Publishing, Ibm Engineering Lifecycle Optimization Publishing.

How do I fix CVE-2021-39016?

No fix has been published for CVE-2021-39016 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2021-39016 being exploited?

There is no known exploitation of CVE-2021-39016 in the wild and no public exploit code.

Sources

Also known as GHSA-g28g-9v8x-765w.