CVE-2023-50308

MEDIUM

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 under certain circumstances could allow an authenticated user to the database to cause a denial of service when a statement is...

Affects 5 products across 3 vendors.

CVSS 3.16.5
EPSS0.8%
Percentile55th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, low privileges required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, no integrity impact, full availability impact.
CWE Weakness Definitions
CWE-20: Improper Input Validation

Software does not validate or incorrectly validates input, allowing attackers to craft data processed in unintended ways.

Related Attack Patterns (CAPEC)
CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
via CWE-20
CAPEC-7 Blind SQL Injection
via CWE-20
CAPEC-8 Buffer Overflow in an API Call
via CWE-20
CAPEC-9 Buffer Overflow in Local Command-Line Utilities
via CWE-20
CAPEC-10 Buffer Overflow via Environment Variables
via CWE-20
Show all 51
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20
via CWE-20

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A medium severity vulnerability affects Ibm systems (CVE-2023-50308). No public exploit code is currently available. Review vendor advisories and apply patches during the next maintenance window.

BSID: BS-2024-GLOBAL-052703-M • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2023-50308?
A medium severity vulnerability affects Ibm systems (CVE-2023-50308). No public exploit code is currently available. Review vendor advisories and apply patches during the next maintenance window.
What is the CVSS score for CVE-2023-50308?
CVE-2023-50308 has CVSS 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS: 0.8%.
Is CVE-2023-50308 actively exploited?
No confirmed active exploitation of CVE-2023-50308 as of 2026-05-30.
How do I remediate CVE-2023-50308?
Priority: LOW. Advisory: https://www.ibm.com/support/pages/node/7105506 PSIRT: [email protected]
What systems are affected by CVE-2023-50308?
CVE-2023-50308 affects Ibm Db2.
Vulnerability Details
CVE IDCVE-2023-50308
BSIDBS-2024-GLOBAL-052703-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published2024-01-22
Last Modified2024-11-21
ICS Relevance0%
Weakness (CWE)
Improper Input Validation
SourceNVD
Official Description

IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 under certain circumstances could allow an authenticated user to the database to cause a denial of service when a statement is run on columnar tables. IBM X-Force ID: 273393.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5 under certain circumstances could allow an authenticated user to the database to cause a denial of service when a statement is run on columnar tables. IBM X-Force ID: 273393. CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Exploitation Likelihood: MINIMAL

Affected Products
VendorProductAffected Versions
Ibm Db2 < 11.5.9

Platforms listed by the source (the vulnerable product runs on these; they are not themselves vulnerable): Ibm Aix, Ibm Linux On Ibm Z, Linux Linux Kernel, Microsoft Windows

Remediation
View Vendor Advisory →

Remediation Priority: LOW

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1002 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Modelrule-based-v1
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hashf150e3bfe8593f6aa372962cdf615dacec616227ab6890e974cd6177b77a6f9a7668cd2d259d439035ea7c75d1aced27d3a3c35f122fb709b90cb2bcc8a54e43
Related CVEs affecting Ibm
CVE-1999-1119 10.0 FTP installation script anon.ftp in AIX insecurely configures anonymous FTP, ... CVE-1999-0099 10.0 Buffer overflow in syslog utility allows local or remote attackers to gain ro... CVE-1999-0088 10.0 IRIX and AIX automountd services (autofsd) allow remote users to execute root... CVE-1999-0101 10.0 Buffer overflow in AIX and Solaris "gethostbyname" library call allows root a... CVE-1999-0097 10.0 The AIX FTP client can be forced to execute commands from a malicious server ...
View all Ibm CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →