IBM Financial Transaction Manager for SWIFT Services for Multiplatforms denial of service

Vulnerability

In IBM Financial Transaction Manager for SWIFT Services for Multiplatforms version 3.2.4, an authenticated user can lock additional RM (Resource Manager) authorizations, leading to a denial of service when displaying or managing these authorizations [1]. The vulnerability is triggered through a specific HTTP request that fails to properly validate authorization boundaries.

Exploitation

An attacker must be an authenticated user with local access to the system (CVSS vector AV:L). No special privileges or user interaction are required. The attacker can send crafted requests to the affected component, locking RM authorizations and preventing legitimate display or management operations.

Impact

Successful exploitation results in a denial of service on the authorization management functionality. The confidentiality and integrity of the system are not affected, but availability is severely impacted (CVSS A:H) [1].

Mitigation

As of the advisory publication date (2022-12-20), no fix or workaround has been provided. Users are advised to contact IBM support for further assistance. The affected version is 3.2.4; upgrading to a later version or applying a patch if available is recommended.