Sterling Partner Engagement Manager Essentials Edition
Monthly
Unauthenticated remote attackers can degrade the email service of IBM Sterling Partner Engagement Manager (PEM) by flooding it with requests, exploiting improper control of interaction frequency (CWE-799) so the service is unable to keep up with legitimate mail processing. The affected releases are Essentials Edition 6.3.0.0 through 6.3.0.2 and 6.2.4.0 through 6.2.4.4, plus Standard Edition 6.2.4.0 through 6.2.4.4; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 Medium), no authentication or user interaction is required against a default configuration when the email service is network-reachable. Impact is limited to partial availability loss (A:L) with no confidentiality or integrity effect and no scope change, so this is a service-degradation weakness rather than a full application outage; no public exploit code has been identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis.
Unauthenticated remote attackers can degrade the email service of IBM Sterling Partner Engagement Manager (PEM) by flooding it with requests, exploiting improper control of interaction frequency (CWE-799) so the service is unable to keep up with legitimate mail processing. The affected releases are Essentials Edition 6.3.0.0 through 6.3.0.2 and 6.2.4.0 through 6.2.4.4, plus Standard Edition 6.2.4.0 through 6.2.4.4; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3 Medium), no authentication or user interaction is required against a default configuration when the email service is network-reachable. Impact is limited to partial availability loss (A:L) with no confidentiality or integrity effect and no scope change, so this is a service-degradation weakness rather than a full application outage; no public exploit code has been identified and the flaw is not listed in CISA KEV, so there is no public exploit identified at time of analysis.