Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus are vulnerable to SOAPAction spoofing when processing JAX-WS Web Services requests (CVE-2022-38712)

Summary

IBM App Connect Enterprise and IBM Integration Bus are vulnerable to SOAPAction spoofing when processing JAX-WS Web Services requests (CVE-2022-38712). The fix includes the IBM Websphere Application Server APAR PH49111

Vulnerability Details

CVEID:CVE-2022-38712
**DESCRIPTION:**IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/234762 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

Remediation/Fixes

IBM strongly recommends addressing the vulnerabilities now by applying the appropriate fix to IBM App Connect Enterprise and IBM Integration Bus

Product(s)

|

Version(s)

|

APAR

|

Remediation / Fix

—|—|—|—

IBM App Connect Enterprise

|

v12.0.1.0 - v12.0.7.0

|

IT42706

|

Interim fix for APAR (IT42706) is available from

IBM Fix Central

IBM App Connect Enterprise

|

v11.0.0.0 - v11.0.0.19

|

IT42706

|

Interim fix for APAR (IT42706) is available from

IBM Fix Central

IBM Integration Bus

|

v10.0.0.0 - v10.0.0.26

|

IT42706

|

Interim fix for APAR (IT42706) is available from

IBM Fix Central

Workarounds and Mitigations

None