IBMD80C1F0811BE6F338F58BD5EE56850D739001FC69CEB4CACAAF9F41A0999D812Security Bulletin: OAuthlib is vulnerable to CVE-2022-36087 used in IBM Maximo Application Suite
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS
Percentile
68.0%
Summary
IBM Maximo Application Suite uses OAuthlib which is vulnerable to CVE-2022-36087.
Vulnerability Details
CVEID:CVE-2022-36087
**DESCRIPTION:**OAuthlib is vulnerable to a denial of service, caused by improper input validation. By sending a specially-crafted request using IPV6 URI, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.
CVSS Base score: 5.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/235780 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Maximo Application Suite | 8.8 |
| IBM Maximo Application Suite | 8.9 |
Remediation/Fixes
| Affected Product(s) | Fix pack Version(s) |
|---|---|
| IBM Maximo Application Suite | 8.8.6 or latest (available from the Catalog under Update Available) |
| IBM Maximo Application Suite | 8.9.2 or latest (available from the Catalog under Update Available) |
Workarounds and Mitigations
None
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ibm | maximo_application_suite | 8.8 | cpe:2.3:a:ibm:maximo_application_suite:8.8:*:*:*:*:*:*:* |
| ibm | maximo_application_suite | 8.9 | cpe:2.3:a:ibm:maximo_application_suite:8.9:*:*:*:*:*:*:* |
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS
Percentile
68.0%