Lucene search

IBM4D4D3CF02DE22DEE0192ED39673747017EF75A59375F35F4FDACA31A8A6E2A51

HistoryJul 18, 2022 - 11:48 a.m.

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to reflected cross-site scripting (CVE-2022-22417)

2022-07-1811:48:29

www.ibm.com

ibm sterling partner engagement manager

cross-site scripting

cve-2022-22417

security bulletin

CVSS3

5.4

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

19.6%

JSON

Summary

IBM Sterling Partner Engagement Manager has addressed a cross-site scripting (XSS) vulnerability.

Vulnerability Details

CVEID:CVE-2022-22417
**DESCRIPTION:**IBM Sterling Partner Engagement Manager is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/223127 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Sterling Partner Engagement Manager Essentials Edition	6.1.2
IBM Sterling Partner Engagement Manager Standard Edition	6.1.2
IBM Sterling Partner Engagement Manager Essentials Edition	6.2
IBM Sterling Partner Engagement Manager Standard Edition	6.2
IBM Sterling Partner Engagement Manager on Cloud / SaaS	22.2

Remediation/Fixes

Product	Version	Remediation / Link
IBM Sterling Partner Engagement Manager Essentials Edition	6.1.2	6.1.2.5 / http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Essentials_6.1.2.5&source=SAR
IBM Sterling Partner Engagement Manager Standard Edition	6.1.2	6.1.2.5 / http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Standard_6.1.2.5&source=SAR
IBM Sterling Partner Engagement Manager Essentials Edition	6.2	6.2.0.3 / http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Essentials_6.2.0.3&source=SAR
IBM Sterling Partner Engagement Manager Standard Edition	6.2	6.2.0.3 / http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Standard_6.2.0.3&source=SAR
IBM Sterling Partner Engagement Manager on Cloud / SaaS	22.2	22.2.1 / us.icr.io/gold/pem:22.2.1

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmpartner_engagement_managerMatch6.1

VendorProductVersionCPE
ibmpartner_engagement_manager6.1cpe:2.3:a:ibm:partner_engagement_manager:6.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	partner_engagement_manager	6.1	cpe:2.3:a:ibm:partner_engagement_manager:6.1:::::::*