IbmVULNRICHMENT:CVE-2022-33167CVE-2022-33167 IBM Security Directory Integrator information disclosure
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
32.5%
SSVC
Exploitation
none
Automatable
no
Technical Impact
partial
IBM Security Directory Integrator 7.2.0 and IBM Security Verify Directory Integrator 10.0.0 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie. IBM X-Force ID: 228587.
CNA Affected
[
{
"vendor": "IBM",
"product": "Security Directory Integrator",
"versions": [
{
"status": "affected",
"version": "7.2.0"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "IBM",
"product": "Security Verify Directory Integrator",
"versions": [
{
"status": "affected",
"version": "10.0.0"
}
],
"defaultStatus": "unaffected"
}
]Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
32.5%
SSVC
Exploitation
none
Automatable
no
Technical Impact
partial