Security Bulletin: IBM Security Directory Integrator vulnerable to sensitive data exposure (CVE-2022-33167)

Summary

A Security Vulnerability discovered in the IBM Security Directory Integrator which could disclose sensitive information has affected the IBM Security Directory Server. The issue was addressed in an update.

Vulnerability Details

CVEID:CVE-2022-33167
**DESCRIPTION:**IBM Security Directory Server could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.
CVSS Base score: 3.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/228587 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

IBM Strongly recommends that customers update to the latest versions of software.

IBM Security Directory Integrator 10.0.0 Container images can be found in the documentation here.

https://www.ibm.com/docs/en/svdi/10.0.0?topic=containers-images

Principal Product and Versions

|

Fix Availability

—|—

IBM Security Director Integrator 7.2.0

|

7.2.0-ISS-SDI-FP0009

IBM Security Directory Integrator 10.0.0

|

ibm-svdi-10.0.0.1

Workarounds and Mitigations

None