Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM881B1CEDE402F3C0480FE03E0BABAF4D1360F266E2536C6F6A95FB60E6D759FC
HistoryJul 18, 2022 - 3:23 p.m.

Security Bulletin: IBM UrbanCode Release is vulnerable to a bypass of security restrictions due to use of Apache Tomcat (CVE-2022-25762).

2022-07-1815:23:29
www.ibm.com
12
ibm urbancode release
apache tomcat
cve-2022-25762
security restrictions
websocket
upgrade

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

EPSS

0.006

Percentile

78.6%

JSON

Summary

Apache Tomcat is used by IBM UrbanCode Release. This fix includes Apache Tomcat 8.5.79.

Vulnerability Details

CVEID:CVE-2022-25762
**DESCRIPTION:**Apache Tomcat could allow a remote attacker to bypass security restrictions, caused by improper error handling in WebSocket connection. By sending a specially-crafted WebSocket message concurrently with the WebSocket connection closing, an attacker could exploit this vulnerability to continue to use the socket after it has been closed.
CVSS Base score: 8.6
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/226498 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L)

Affected Products and Versions

Affected Product(s) Version(s)
IBM UrbanCode Release 6.2.5 - 6.2.5.5

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now by upgrading to IBM UrbanCode Release version 6.2.5.6 or above.

Affected Supporting Product(s) Remediation/Fix
IBM UrbanCode Release 6.2.5 - 6.2.5.5 Download IBM UrbanCode Release 6.2.5.6 – Includes Apache Tomcat 8.5.79

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmrationalMatch6.2.5.6
VendorProductVersionCPE
ibmrational6.2.5.6cpe:2.3:a:ibm:rational:6.2.5.6:*:*:*:*:*:*:*

Related

veracode 1
debiancve 1
kaspersky 1
cnvd 1
github 1
prion 1
cvelist 1
osv 4
openvas 2
ibm 6
nessus 11
f5 1
nvd 1
ubuntucve 1
redhatcve 1
tomcat 2
cve 1
amazon 1
rosalinux 1
rocky 1
redhat 1
oracle 1
veracode
veracode
Command Injection
2022-09-05 19:23:03
debiancve
debiancve
CVE-2022-25762
2022-05-13 08:15:06
kaspersky
kaspersky
KLA12560 DoS vulnerability in Apache Tomcat
2022-02-28 00:00:00
cnvd
cnvd
Apache Tomcat Request Obfuscation Vulnerability
2022-05-17 00:00:00
github
github
Improper socket reuse in Apache Tomcat
2022-05-14 00:01:50
prion
prion
Code injection
2022-05-13 08:15:00
cvelist
cvelist
CVE-2022-25762 Response mix-up with WebSocket concurrent send and close
2022-05-13 07:50:09
osv
osv
Improper socket reuse in Apache Tomcat
2022-05-14 00:01:50
CVE-2022-25762
2022-05-13 08:15:06
BIT-tomcat-2022-25762
2024-03-06 11:09:31
openvas
openvas
Apache Tomcat Request Mix-up Vulnerability (May 2022) - Windows
2022-05-13 00:00:00
Apache Tomcat Request Mix-up Vulnerability (May 2022) - Linux
2022-05-13 00:00:00
ibm
ibm
Security Bulletin: Vulnerability in Apache Tomcat affects IBM SAN Volume Controller, IBM Storwize, IBM Spectrum Virtualize and IBM FlashSystem products
2023-03-29 01:48:02
Security Bulletin: IBM UrbanCode Build is vulnerable to a bypass of security restrictions due to use of Apache Tomcat (CVE-2022-25762).
2022-07-18 15:29:10
Security Bulletin: Vulnerabilities in Apache Tomcat, Apache Commons FileUpload and Apache Axis might affect IBM Storage Copy Data Management
2024-03-22 16:05:48
nessus
nessus
Apache Tomcat 9.0.0.M1 < 9.0.21
2022-05-13 00:00:00
Apache Tomcat 8.5.0 < 8.5.76
2022-05-13 00:00:00
Amazon Linux AMI : tomcat8 (ALAS-2022-1627)
2022-08-05 00:00:00
f5
f5
K49622415 : Apache Tomcat vulnerability CVE-2022-25762
2022-07-07 00:00:00
nvd
nvd
CVE-2022-25762
2022-05-13 08:15:06
ubuntucve
ubuntucve
CVE-2022-25762
2022-05-13 00:00:00
redhatcve
redhatcve
CVE-2022-25762
2022-05-13 00:41:04
tomcat
tomcat
Fixed in Apache Tomcat 8.5.76
2022-02-28 00:00:00
Fixed in Apache Tomcat 9.0.21
2019-06-07 00:00:00
cve
cve
CVE-2022-25762
2022-05-13 08:15:06
amazon
amazon
Important: tomcat8
2022-07-28 20:39:00
rosalinux
rosalinux
Advisory ROSA-SA-2023-2258
2023-10-21 16:49:43
rocky
rocky
pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
2020-11-03 12:29:58
redhat
redhat
(RHSA-2020:4847) Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
2020-11-03 12:29:58
oracle
oracle
Oracle Critical Patch Update Advisory - July 2022
2022-07-19 00:00:00

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

8.6

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

EPSS

0.006

Percentile

78.6%

JSON
Related for 881B1CEDE402F3C0480FE03E0BABAF4D1360F266E2536C6F6A95FB60E6D759FC
veracode1debiancve1kaspersky1cnvd1github1prion1cvelist1osv4openvas2ibm6nessus11f51nvd1ubuntucve1redhatcve1tomcat2cve1amazon1rosalinux1rocky1redhat1oracle1