Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM4B359CA4B0F5A1DFAAD92448F6C770BC211528A1C45B95F482F09529884DE1D2
HistoryOct 08, 2022 - 3:26 p.m.

Security Bulletin: IBM Partner Engagement Manager vulnerable to authentication bypass (CVE-2022-34334)

2022-10-0815:26:52
www.ibm.com
17
ibm
partner engagement manager
authentication bypass
vulnerability
fixed

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

19.6%

JSON

Summary

IBM Sterling Partner Engagement Manager has addressed an authentication bypass vulnerability.

Vulnerability Details

CVEID:CVE-2022-34334
**DESCRIPTION:**IBM Sterling Partner Engagement Manager does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.
CVSS Base score: 6.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/229704 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Affected Product(s) Version(s)
IBM Sterling Partner Engagement Manager 2.0

Remediation/Fixes

Product Version Remediation
IBM Sterling Partner Engagement Manager Essentials Edition 6.1.2.6 http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Essentials_6.1.2.6&source=SAR
IBM Sterling Partner Engagement Manager Standard Edition 6.1.2.6 http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Standard_6.1.2.6&source=SAR
IBM Sterling Partner Engagement Manager Essentials Edition 6.2.0.4 http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Essentials_6.2.0.4&source=SAR
IBM Sterling Partner Engagement Manager Standard Edition 6.2.0.4 http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Standard_6.2.0.4&source=SAR
IBM Sterling Partner Engagement Manager Essentials Edition 6.2.1.1 http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Essentials_6.2.1.1&source=SAR
IBM Sterling Partner Engagement Manager Standard Edition 6.2.1.1 https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Standard_6.2.1.1&source=SAR

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmpartner_engagement_managerMatch6.1
VendorProductVersionCPE
ibmpartner_engagement_manager6.1cpe:2.3:a:ibm:partner_engagement_manager:6.1:*:*:*:*:*:*:*

Related

cve 1
cvelist 1
nvd 1
cnvd 1
prion 1
cve
cve
CVE-2022-34334
2022-10-10 21:15:11
cvelist
cvelist
CVE-2022-34334
2022-10-10 20:43:16
nvd
nvd
CVE-2022-34334
2022-10-10 21:15:11
cnvd
cnvd
IBM Sterling Partner Engagement Manager has an unspecified vulnerability (CNVD-2022-68275)
2022-10-11 00:00:00
prion
prion
Code injection
2022-10-10 21:15:00

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

19.6%

JSON
Related for 4B359CA4B0F5A1DFAAD92448F6C770BC211528A1C45B95F482F09529884DE1D2
cve1cvelist1nvd1cnvd1prion1