Sign-up

ID

VAR-202202-1475


CVE

CVE-2022-22326


TITLE

IBM Datapower Gateway  Fraud related to unauthorized authentication in

Trust: 0.8

sources: JVNDB: JVNDB-2022-016047

DESCRIPTION

IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and files due to insufficient authorization checks. IBM X-Force ID: 218856. IBM Datapower Gateway contains an invalid authentication vulnerability. Vendors may IBM X-Force ID: 218856 It is published as.Information may be obtained

Trust: 1.8

sources: NVD: CVE-2022-22326 // JVNDB: JVNDB-2022-016047 // VULHUB: VHN-410895 // VULMON: CVE-2022-22326

AFFECTED PRODUCTS

vendor:ibmmodel:datapower gatewayscope:gteversion:10.0.1.0

Trust: 1.0

vendor:ibmmodel:mq appliance m2001scope:ltversion:9.2.5

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:ltversion:10.0.5.0

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:gteversion:2018.4.1.0

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:gteversion:10.0.2.0

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:ltversion:2018.4.1.19

Trust: 1.0

vendor:ibmmodel:mq appliance m2002scope:ltversion:9.2.0.5

Trust: 1.0

vendor:ibmmodel:datapower gatewayscope:ltversion:10.0.1.6

Trust: 1.0

vendor:ibmmodel:mq appliance m2001scope:ltversion:9.2.0.5

Trust: 1.0

vendor:ibmmodel:mq appliance m2002scope:ltversion:9.2.5

Trust: 1.0

vendor:ibmmodel:mq appliance m2001scope: - version: -

Trust: 0.8

vendor:ibmmodel:mq appliance m2002scope: - version: -

Trust: 0.8

vendor:ibmmodel:datapower gatewayscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2022-016047 // NVD: CVE-2022-22326

CVSS

SEVERITY

CVSSV2

CVSSV3

psirt@us.ibm.com: CVE-2022-22326
value: MEDIUM

Trust: 1.0

nvd@nist.gov: CVE-2022-22326
value: LOW

Trust: 1.0

NVD: CVE-2022-22326
value: LOW

Trust: 0.8

CNNVD: CNNVD-202202-2199
value: LOW

Trust: 0.6

psirt@us.ibm.com: CVE-2022-22326
baseSeverity: MEDIUM
baseScore: 4.0
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.5
impactScore: 1.4
version: 3.0

Trust: 1.0

nvd@nist.gov: CVE-2022-22326
baseSeverity: LOW
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 1.8
impactScore: 1.4
version: 3.1

Trust: 1.0

NVD: CVE-2022-22326
baseSeverity: LOW
baseScore: 3.3
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: JVNDB: JVNDB-2022-016047 // CNNVD: CNNVD-202202-2199 // NVD: CVE-2022-22326 // NVD: CVE-2022-22326

PROBLEMTYPE DATA

problemtype:CWE-863

Trust: 1.1

problemtype:Illegal authentication (CWE-863) [NVD evaluation ]

Trust: 0.8

sources: VULHUB: VHN-410895 // JVNDB: JVNDB-2022-016047 // NVD: CVE-2022-22326

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-202202-2199

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202202-2199

PATCH

title:ibm-mq-cve202222326-info-disc (218856)url:https://www.ibm.com/support/pages/node/6560048

Trust: 0.8

title:IBM MQ Appliance Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=203678

Trust: 0.6

sources: JVNDB: JVNDB-2022-016047 // CNNVD: CNNVD-202202-2199

EXTERNAL IDS

db:NVDid:CVE-2022-22326

Trust: 3.4

db:JVNDBid:JVNDB-2022-016047

Trust: 0.8

db:AUSCERTid:ESB-2022.0854

Trust: 0.6

db:CNNVDid:CNNVD-202202-2199

Trust: 0.6

db:VULHUBid:VHN-410895

Trust: 0.1

db:VULMONid:CVE-2022-22326

Trust: 0.1

sources: VULHUB: VHN-410895 // VULMON: CVE-2022-22326 // JVNDB: JVNDB-2022-016047 // CNNVD: CNNVD-202202-2199 // NVD: CVE-2022-22326

REFERENCES

url:https://www.ibm.com/support/pages/node/6560048

Trust: 1.8

url:https://www.ibm.com/support/pages/node/6608598

Trust: 1.8

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/218856

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2022-22326

Trust: 0.8

url:https://cxsecurity.com/cveshow/cve-2022-22326/

Trust: 0.6

url:https://vigilance.fr/vulnerability/ibm-mq-appliance-file-reading-via-insufficient-authorisation-checks-37668

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.0854

Trust: 0.6

url:https://nvd.nist.gov

Trust: 0.1

sources: VULHUB: VHN-410895 // VULMON: CVE-2022-22326 // JVNDB: JVNDB-2022-016047 // CNNVD: CNNVD-202202-2199 // NVD: CVE-2022-22326

SOURCES

db:VULHUBid:VHN-410895
db:VULMONid:CVE-2022-22326
db:JVNDBid:JVNDB-2022-016047
db:CNNVDid:CNNVD-202202-2199
db:NVDid:CVE-2022-22326

LAST UPDATE DATE

2024-08-14T15:42:33.763000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-410895date:2022-08-04T00:00:00
db:VULMONid:CVE-2022-22326date:2022-08-01T00:00:00
db:JVNDBid:JVNDB-2022-016047date:2023-10-02T01:37:00
db:CNNVDid:CNNVD-202202-2199date:2022-08-10T00:00:00
db:NVDid:CVE-2022-22326date:2022-08-04T17:36:12.380

SOURCES RELEASE DATE

db:VULHUBid:VHN-410895date:2022-08-01T00:00:00
db:VULMONid:CVE-2022-22326date:2022-08-01T00:00:00
db:JVNDBid:JVNDB-2022-016047date:2023-10-02T00:00:00
db:CNNVDid:CNNVD-202202-2199date:2022-02-28T00:00:00
db:NVDid:CVE-2022-22326date:2022-08-01T11:15:13.150