Lucene search

IbmCVE-2022-22484

HistoryMay 17, 2022 - 4:15 p.m.

CVE-2022-22484

2022-05-1716:15:09

CWE-312

ibm

web.nvd.nist.gov

ibm

spectrum

protect

operations center

vulnerability

local attacker

information disclosure

cve-2022-22484

nvd

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

Percentile

5.1%

JSON

IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, caused by plain text user account passwords potentially being stored in the browser’s application command history. By accessing browser history, an attacker could exploit this vulnerability to obtain other user accounts’ passwords. IBM X-Force ID: 226322.

Affected configurations

Nvd

Vulners

Node

ibmspectrum_protectRange8.1.12.000–8.1.14

AND

ibmaixMatch-

linuxlinux_kernelMatch-

microsoftwindowsMatch-

VendorProductVersionCPE
ibmspectrum_protect*cpe:2.3:a:ibm:spectrum_protect:*:*:*:*:*:*:*:*
ibmaix-cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*
linuxlinux_kernel-cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
microsoftwindows-cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	spectrum_protect	*	cpe:2.3:a:ibm:spectrum_protect::::::::
ibm	aix	-	cpe:2.3:o:ibm:aix:-:::::::*
linux	linux_kernel	-	cpe:2.3:o:linux:linux_kernel:-:::::::*
microsoft	windows	-	cpe:2.3:o:microsoft:windows:-:::::::*

CNA Affected

[
  {
    "product": "Spectrum Protect Operations Center",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "8.1.13"
      },
      {
        "status": "affected",
        "version": "8.1.12"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/226322

www.ibm.com/support/pages/node/6586314

Social References

CVSS2

2.1

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.2

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2022-22484