Lucene search

IBM8D9A823C3A9A87570CBAF392A26D05722DA2F8D0161FC9D53E205D6F0B50A55E

HistorySep 06, 2022 - 11:10 p.m.

Security Bulletin: Rational Asset Analyzer is vulnerable to Identity Spoofing (CVE-2022-22475)

2022-09-0623:10:54

www.ibm.com

ibm

websphere

rational asset analyzer

vulnerability

identity spoofing

fix

fix central

upgrade

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

19.6%

JSON

Summary

IBM WebSphere Application Server Liberty used by Rational Asset analyzer is vulnerable to identity spoofing with the appSecurity-1.0, appSecurity-2.0, appSecurity-3.0 or appSecurity-4.0 feature enabled. This has been addressed.

Vulnerability Details

CVEID:CVE-2022-22475
**DESCRIPTION:**IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 are vulnerable to identity spoofing by an authenticated user. IBM X-Force ID: 225603.
CVSS Base score: 7.1
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/225603 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L)

Affected Products and Versions

Affected Product(s)	Version(s)
Rational Asset Analyzer (RAA)	6.1.0.0 - 6.1.0.23

Remediation/Fixes

Apply the corresponding fix from FIX Central. Note the release date of 2022/09/01

Windows Version	Fix Central
z/OS Version	Fix Central

IBM strongly recommends addressing the vulnerability now by upgrading.

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmrational_asset_analyzerMatch6.1.0.0

ibmrational_asset_analyzerMatch6.1.0.23

VendorProductVersionCPE
ibmrational_asset_analyzer6.1.0.0cpe:2.3:a:ibm:rational_asset_analyzer:6.1.0.0:*:*:*:*:*:*:*
ibmrational_asset_analyzer6.1.0.23cpe:2.3:a:ibm:rational_asset_analyzer:6.1.0.23:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	rational_asset_analyzer	6.1.0.0	cpe:2.3:a:ibm:rational_asset_analyzer:6.1.0.0:::::::*
ibm	rational_asset_analyzer	6.1.0.23	cpe:2.3:a:ibm:rational_asset_analyzer:6.1.0.23:::::::*

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS

0.001

Percentile

19.6%

JSON

Related for 8D9A823C3A9A87570CBAF392A26D05722DA2F8D0161FC9D53E205D6F0B50A55E