CVE-2023-33842 IBM SPSS Modeler information disclosure

What is CVE-2023-33842?

CVE-2023-33842 is a medium-severity vulnerability in IBM SPSS Modeler, published on 22 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

IBM SPSS Modeler on Windows 17.0, 18.0, 18.2.2, 18.3, 18.4, and 18.5 requires the end user to have access to the server SSL key which could allow a local user to decrypt and obtain sensitive information. IBM X-Force ID: 256117.

Which versions are affected by CVE-2023-33842?

It affects 1 product.

Products include Ibm Spss Modeler.

How do I fix CVE-2023-33842?

No fix has been published for CVE-2023-33842 yet. Limit exposure of the affected software until one is available.

Is CVE-2023-33842 being exploited?

There is no known exploitation of CVE-2023-33842 in the wild and no public exploit code.

Other vulnerabilities in IBM SPSS Modeler

• CVE-2020-4717 Path traversal in SPSS Modeler Medium 6.2
• CVE-2012-5769 XML external entity in n/a Medium 5.8
• CVE-2013-6739 Auth bypass in n/a Medium 5.4
• CVE-2015-4991 Information disclosure in n/a Medium 4.0
• CVE-2014-3038 Privilege escalation in n/a Low 3.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-qwq9-2p2q-h6vm.