9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.01 Low
EPSS
Percentile
83.4%
Automation Assets in IBM Cloud Pak for Integration is vulnerable to webpack loader-utils vulnerability with details below. [CVE-2022-37601] This vulnerability has been addressed.
CVEID:CVE-2022-37601
**DESCRIPTION:**webpack loader-utils could allow a remote attacker to execute arbitrary code on the system, caused by a prototype pollution flaw in the parseQuery function in parseQuery.js. By adding or modifying properties of Object.prototype using a proto or constructor payload, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/238763 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Product(s) | Version(s) |
---|---|
Automation Assets in IBM Cloud Pak for Integration (CP4I) | 2020.4.1 |
2021.1.1 | |
2021.2.1 | |
2021.4.1 | |
2022.2.1 |
IBM strongly suggests the following remediation / fix:
Automation Assets version 2020.4.1, 2021.1, 2021.2,** 2021.4, or 2022.2 in IBM Cloud Pak for Integration**
Upgrade Automation Assets Operator to 2022.2.1-4 using the Operator upgrade process described in the IBM Documentation
None
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.01 Low
EPSS
Percentile
83.4%