Lucene search

IBM4ECFA5C2A7456F896D44B0E2BD545EC6EF39A1C4D63BE6899754E4B8B22572B7

HistoryJan 16, 2023 - 2:19 p.m.

Security Bulletin: IBM Sterling Partner Engagement Manager is vulnerable to spoofing attacks due to WAS Liberty (CVE-2018-25031, CVE-2021-46708)

2023-01-1614:19:00

www.ibm.com

ibm sterling partner engagement manager

vulnerability

spoofing attacks

was liberty

cve-2018-25031

cve-2021-46708

versions 6.1.2

6.2.0

6.2.1.

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.003

Percentile

71.9%

JSON

Summary

IBM Sterling Partner Engagement Manager has addressed all vulnerabilities published by WAS liberty below.

Vulnerability Details

CVEID:CVE-2018-25031
**DESCRIPTION:**swagger-ui could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a specially-crafted URL, an attacker could exploit this vulnerability to display remote OpenAPI definitions.
CVSS Base score: 5.4
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217346 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)

CVEID:CVE-2021-46708
**DESCRIPTION:**npm swagger-ui-dist could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim’s click actions and possibly launch further attacks against the victim.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/217359 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Sterling Partner Engagement Manager	6.1.2, 6.2.0, 6.2.1

Remediation/Fixes

Product	Version	Remediation
IBM Sterling Partner Engagement Manager Essentials Edition	6.1.2.7	http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Essentials_6.1.2.7&source=SAR
IBM Sterling Partner Engagement Manager Standard Edition	6.1.2.7	http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Standard_6.1.2.7&source=SAR
IBM Sterling Partner Engagement Manager Essentials Edition	6.2.0.5	http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Essentials_6.2.0.5&source=SAR
IBM Sterling Partner Engagement Manager Standard Edition	6.2.0.5	http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Standard_6.2.0.5&source=SAR
IBM Sterling Partner Engagement Manager Essentials Edition	6.2.1.2	http://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Essentials_6.2.1.2&source=SAR
IBM Sterling Partner Engagement Manager Standard Edition	6.2.1.2	https://www.ibm.com/support/fixcentral/swg/selectFixes?product=ibm%2FOther+software%2FIBM+Sterling+Partner+Engagement+Manager+Software&fixids=IBM_PEM_Standard_6.2.1.2&source=SAR

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmmulti-enterprise_integration_gatewayMatch6.1

ibmmulti-enterprise_integration_gatewayMatch6.2

ibmmulti-enterprise_integration_gatewayMatch6.2.1

VendorProductVersionCPE
ibmmulti-enterprise_integration_gateway6.1cpe:2.3:a:ibm:multi-enterprise_integration_gateway:6.1:*:*:*:*:*:*:*
ibmmulti-enterprise_integration_gateway6.2cpe:2.3:a:ibm:multi-enterprise_integration_gateway:6.2:*:*:*:*:*:*:*
ibmmulti-enterprise_integration_gateway6.2.1cpe:2.3:a:ibm:multi-enterprise_integration_gateway:6.2.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	multi-enterprise_integration_gateway	6.1	cpe:2.3:a:ibm:multi-enterprise_integration_gateway:6.1:::::::*
ibm	multi-enterprise_integration_gateway	6.2	cpe:2.3:a:ibm:multi-enterprise_integration_gateway:6.2:::::::*
ibm	multi-enterprise_integration_gateway	6.2.1	cpe:2.3:a:ibm:multi-enterprise_integration_gateway:6.2.1:::::::*