CVE-2023-47142 is a high severity flaw in IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10, scored 7.5. Unauthorized API access lets an attacker on the local network escalate privileges. IBM's fix is TADDM fix pack 7.3.0.11, so upgrade and limit network access.
What's affected
IBM's bulletin lists IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 as affected. The remediation is to upgrade by installing TADDM FixPack 7.3.0.11, identified as 7.3-TIV-ITADDM-FP00011.
The bulletin covers three CVEs together. This one is the privilege escalation through unauthorized API access. The others are a Host header injection, CVE-2023-47143, and a cross-site scripting issue, CVE-2023-47144. One fix pack closes all three.
The record and IBM agree on 7.5 and on an adjacent network vector with high attack complexity. That vector is why the description speaks of an attacker on the organization's local network.
The NVD record was published on 2024-02-02, scores 7.5 (High), and carries the vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Weakness class: CWE-863.
How to check if you're exposed
Find your TADDM version from the product's version information or administrative console, using IBM's documentation for your install, and compare it with 7.3.0.11. IBM's fix pack release notes describe where the level is shown.
Anything from 7.3.0.0 through 7.3.0.10 is affected. Also list which network segments can reach the TADDM server and its API, since the flaw requires local network access. Pay attention to desktop and guest networks, which should not reach it.
What to do now
- Confirm your TADDM version against the 7.3.0.0 to 7.3.0.10 range.
- Download and install fix pack 7.3.0.11 following IBM's release notes.
- Restrict the API to the management network, and block it from user segments.
- Review API and administrative activity logs from before the fix.
- Read the bulletin's sibling issues and confirm they are resolved by the same fix pack.
Why it matters
The weakness is CWE-863, incorrect authorization. The API does not check properly whether a caller may perform an action, so a user or device on the network gains rights they should not have.
TADDM stores detailed information about applications and infrastructure, which makes it a map of your environment. Elevated access there helps an attacker plan their next steps. The record's KEV flag is false, so this CVE is not on the CISA Known Exploited Vulnerabilities list.
Segmenting management tools from user networks is the control that limits exposure to adjacent attackers.
The high attack complexity in the score reflects that an attacker needs the right position and conditions. Do not read it as a reason to delay. Inventory tools like TADDM are quiet, rarely reviewed, and often forgotten when teams plan patch cycles, so add the fix pack to your next change window and confirm afterward that the version reads 7.3.0.11.
Quick check
What fixes it?
IBM lists TADDM fix pack 7.3.0.11 for all affected versions from 7.3.0.0 through 7.3.0.10.
Sources
Last reviewed: 19 October 2026.
