CVE-2023-30441: IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could

This month

HIGH 7.5REMOTEDOWNGRADEUPGRADEUPGRADE

CVE-2023-30441 is a high-severity flaw (CVSS 7.5) affecting infosphere information server, java, websphere application server. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188.

Why this priority

High severity
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.6% (top 51%)
CISA exploited list	No
Weakness	CWE-327
Published	2023-04-29
Last modified	2026-06-17

Publisher (CNA): IBM Corporation · Vendor: ibm

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2023-04-29 15:15 UTCPublished CVE record published
2026-06-17 05:54 UTCUpdated Record last modified

ibm infosphere information server DOWNGRADE

Affected: 11.7

Fixed in: no fixed release known

Safe to downgrade to: a release before 11.7

1. Check installed version

apt-cache policy infosphere-information-server || rpm -q infosphere-information-server || infosphere-information-server --version

2. No fixed release: DOWNGRADE to a release before 11.7 (Debian / Ubuntu)

apt-cache madison infosphere-information-server sudo apt install infosphere-information-server=<VERSION_BEFORE_11.7> sudo apt-mark hold infosphere-information-server

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list infosphere-information-server sudo dnf downgrade infosphere-information-server-<VERSION_BEFORE_11.7> sudo dnf versionlock add infosphere-information-server

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

ibm java UPGRADE

Affected: >= 8.0.7.0 and < 8.0.7.15

Fixed in: 8.0.7.15

Safe to downgrade to: a release before 8.0.7.0

1. Check installed version

apt-cache policy java || rpm -q java || java --version

2. UPGRADE to 8.0.7.15 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade java

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade java

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 8.0.7.0 (Debian / Ubuntu)

apt-cache madison java sudo apt install java=<VERSION_BEFORE_8.0.7.0> sudo apt-mark hold java

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list java sudo dnf downgrade java-<VERSION_BEFORE_8.0.7.0> sudo dnf versionlock add java

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

ibm websphere application server UPGRADE

Affected: >= 8.5.0.0 and < 8.5.5.23 · all versions · 9.0.0.0

Fixed in: 8.5.5.23

Safe to downgrade to: a release before 8.5.0.0

1. Check installed version

apt-cache policy websphere-application-server || rpm -q websphere-application-server || websphere-application-server --version

2. UPGRADE to 8.5.5.23 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade websphere-application-server

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade websphere-application-server

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

3. If no update is available yet, DOWNGRADE to a release before 8.5.0.0 (Debian / Ubuntu)

apt-cache madison websphere-application-server sudo apt install websphere-application-server=<VERSION_BEFORE_8.5.0.0> sudo apt-mark hold websphere-application-server

3. If no update is available yet, DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list websphere-application-server sudo dnf downgrade websphere-application-server-<VERSION_BEFORE_8.5.0.0> sudo dnf versionlock add websphere-application-server

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

ibm z\/transaction processing facility DOWNGRADE

Affected: 1.1

Fixed in: no fixed release known

Safe to downgrade to: a release before 1.1

1. Check installed version

apt-cache policy ztransaction-processing-facility || rpm -q ztransaction-processing-facility || ztransaction-processing-facility --version

2. No fixed release: DOWNGRADE to a release before 1.1 (Debian / Ubuntu)

apt-cache madison ztransaction-processing-facility sudo apt install ztransaction-processing-facility=<VERSION_BEFORE_1.1> sudo apt-mark hold ztransaction-processing-facility

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list ztransaction-processing-facility sudo dnf downgrade ztransaction-processing-facility-<VERSION_BEFORE_1.1> sudo dnf versionlock add ztransaction-processing-facility

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2023-30441?

infosphere information server: downgrade or apply the listed mitigation; java: upgrade to 8.0.7.15; websphere application server: upgrade to 8.5.5.23. Exact commands for each OS are on this page.

Is CVE-2023-30441 being exploited?

CVE-2023-30441 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2023-30441 affect?

CVE-2023-30441 affects infosphere information server, java, websphere application server. Severity is high (CVSS 7.5). IBM Runtime Environment, Java Technology Edition IBMJCEPlus and JSSE 8.0.7.0 through 8.0.7.11 components could expose sensitive information using a combination of flaws and configurations. IBM X-Force ID: 253188.

How urgent is CVE-2023-30441?

Priority 43/100. High severity; Remotely exploitable, no login, no user action

Software pages

Java vulnerabilities · IBM WebSphere vulnerabilities

Related CVEs

CVE-2026-9836 LOW 3.5 UPGRADE IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is affected by an information disclosure vulnerabi
CVE-2025-12531 HIGH 7.1 UPGRADE IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to an XML external entity injection
CVE-2025-36245 HIGH 8.8 UPGRADE IBM InfoSphere 11.7.0.0 through 11.7.1.6 Information Server could allow an authenticated user to execute arbit
CVE-2025-33003 HIGH 7.8 UPGRADE IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 could allow a non-root user to gain higher privile
CVE-2025-12832 MEDIUM 4.6 UPGRADE IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to server-side request forgery (SSRF

References

← Back to latest CVEs