CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
29.7%
Node.js module URI.js is used by IBM App Connect Enterprise Certified Container for processing URIs in Designer flows. IBM App Connect Enterprise Certified Container IntegrationServers that use Designer flows may be vulnerable to CVE-2022-1243. This bulletin provides patch information to address the reported vulnerability CVE-2022-1243 in Node.js module URI.js.
CVEID:CVE-2022-1243
**DESCRIPTION:**URI.js is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the \r, \n, and \t characters. A remote attacker could exploit this vulnerability using incorrect protocol extraction to inject malicious script into a Web page which would be executed in a victim’s Web browser within the security context of the hosting Web site, once the page is viewed. An attacker could use this vulnerability to steal the victim’s cookie-based authentication credentials.
CVSS Base score: 7.2
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/223815 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N)
Affected Product(s) | Version(s) |
---|---|
App Connect Enterprise Certified Container | 1.1-eus with Operator |
App Connect Enterprise Certified Container | 2.1 with Operator |
App Connect Enterprise Certified Container | 3.0 with Operator |
App Connect Enterprise Certified Container | 3.1 with Operator |
App Connect Enterprise Certified Container | 4.0 with Operator |
App Connect Enterprise Certified Container 2.1, 3.0, 3.1 and 4.0 (Continuous Delivery)
Upgrade to App Connect Enterprise Certified Container Operator version 4.1.0 or higher, and ensure that all DesignerAuthoring and IntegrationServer components are at 12.0.4.0-r1 or higher. Documentation on the upgrade process is available at <https://www.ibm.com/docs/en/app-connect/containers_cd?topic=releases-upgrading-operator>
App Connect Enterprise Certified Container 1.1 EUS (Extended Update Support)
Upgrade to App Connect Enterprise Certified Container Operator version 1.1.8 or higher, and ensure that all DesignerAuthoring and IntegrationServer components are at 11.0.0.17-r1-eus or higher. Documentation on the upgrade process is available at <https://www.ibm.com/docs/en/app-connect/containers_eus?topic=releases-upgrading-operator>
None
Vendor | Product | Version | CPE |
---|---|---|---|
ibm | app_connect_enterprise | 1.1.0 | cpe:2.3:a:ibm:app_connect_enterprise:1.1.0:*:*:*:*:*:*:* |
ibm | app_connect_enterprise | 1.1.1 | cpe:2.3:a:ibm:app_connect_enterprise:1.1.1:*:*:*:*:*:*:* |
ibm | app_connect_enterprise | 1.1.2 | cpe:2.3:a:ibm:app_connect_enterprise:1.1.2:*:*:*:*:*:*:* |
ibm | app_connect_enterprise | 1.1.3 | cpe:2.3:a:ibm:app_connect_enterprise:1.1.3:*:*:*:*:*:*:* |
ibm | app_connect_enterprise | 1.1.4 | cpe:2.3:a:ibm:app_connect_enterprise:1.1.4:*:*:*:*:*:*:* |
ibm | app_connect_enterprise | 1.1.5 | cpe:2.3:a:ibm:app_connect_enterprise:1.1.5:*:*:*:*:*:*:* |
ibm | app_connect_enterprise | 1.1.6 | cpe:2.3:a:ibm:app_connect_enterprise:1.1.6:*:*:*:*:*:*:* |
ibm | app_connect_enterprise | 1.1.7 | cpe:2.3:a:ibm:app_connect_enterprise:1.1.7:*:*:*:*:*:*:* |
ibm | app_connect_enterprise | 2.1 | cpe:2.3:a:ibm:app_connect_enterprise:2.1:*:*:*:*:*:*:* |
ibm | app_connect_enterprise | 3.0 | cpe:2.3:a:ibm:app_connect_enterprise:3.0:*:*:*:*:*:*:* |
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS
Percentile
29.7%