IBM6F88D3F43259880CDE0EB9D59BAD7CAD615179D8E600A7506E78148C6A8DCD39Security Bulletin: IBM Workload Scheduler potentially affected by a vulnerability in SnakeYaml (CVE-2022-1471)
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.022 Low
EPSS
Percentile
89.4%
Summary
IBM Workload Scheduler is potentially affected by a vulnerability found in SnakeYaml that can cause a remote code execution attack while deserializing yaml content.
Vulnerability Details
CVEID:CVE-2022-1471
**DESCRIPTION:**SnakeYaml could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in the Constructor class. By using a specially-crafted yaml content, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 8.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/241118 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Workload Scheduler | 10.1 |
Remediation/Fixes
APAR IJ46496 has been opened to address the SnakeYaml vulnerability affecting IBM Workload Scheduler.
APAR IJ46496 is included in IBM Workload Scheduler 10.1.0.3, available on Fix Central.
Workarounds and Mitigations
None
Affected configurations
| CPE | Name | Operator | Version |
|---|---|---|---|
| ibm workload scheduler | eq | 10.1 | |
| ibm workload scheduler | eq | 9.5 |
Related
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.022 Low
EPSS
Percentile
89.4%