Details of VAR-202208-0009

ID

VAR-202208-0009

CVE

CVE-2022-31774

TITLE

IBM DataPower Gateway Cross-site scripting vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-016040

DESCRIPTION

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 228358. Vendor exploits this vulnerability IBM X-Force ID: 228358 It is published as.Information may be obtained and information may be tampered with. IBM DataPower Gateway is a security and integration platform specially designed for mobile, cloud, application programming interface (API), network, service-oriented architecture (SOA), B2B and cloud workloads. The platform secures, integrates and optimizes access across channels with a dedicated gateway platform

Trust: 1.8

sources: NVD: CVE-2022-31774 // JVNDB: JVNDB-2022-016040 // VULHUB: VHN-423624 // VULMON: CVE-2022-31774

AFFECTED PRODUCTS

vendor:	ibm	model:	datapower gateway	scope:	eq	version:	10.5.0.0	Trust: 1.8
vendor:	ibm	model:	datapower gateway	scope:	gte	version:	10.0.1.0	Trust: 1.0
vendor:	ibm	model:	datapower gateway	scope:	lt	version:	10.5.0.1	Trust: 1.0
vendor:	ibm	model:	datapower gateway	scope:	gte	version:	2018.4.1.0	Trust: 1.0
vendor:	ibm	model:	datapower gateway	scope:	gte	version:	10.0.2.0	Trust: 1.0
vendor:	ibm	model:	datapower gateway	scope:	lte	version:	2018.4.1.21	Trust: 1.0
vendor:	ibm	model:	datapower gateway	scope:	lte	version:	10.0.1.8	Trust: 1.0
vendor:	ibm	model:	datapower gateway	scope:	eq	version:	2018.4.1.0 to 2018.4.1.21	Trust: 0.8
vendor:	ibm	model:	datapower gateway	scope:	eq	version:	10.0.2.0 to 10.0.4.0	Trust: 0.8
vendor:	ibm	model:	datapower gateway	scope:	eq	version:	10.0.1.0 to 10.0.1.8	Trust: 0.8
vendor:	ibm	model:	datapower gateway	scope:	eq	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2022-016040 // NVD: CVE-2022-31774

CVSS

SEVERITY

CVSSV2

CVSSV3

psirt@us.ibm.com:	CVE-2022-31774
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2022-31774
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2022-31774
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202208-1842
value:	MEDIUM
Trust: 0.6

psirt@us.ibm.com:	CVE-2022-31774
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.3
impactScore:	2.7
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2022-31774
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.3
impactScore:	2.7
version:	3.1
Trust: 1.0

sources: JVNDB: JVNDB-2022-016040 // CNNVD: CNNVD-202208-1842 // NVD: CVE-2022-31774 // NVD: CVE-2022-31774

PROBLEMTYPE DATA

problemtype:	CWE-79	Trust: 1.1
problemtype:	Cross-site scripting (CWE-79) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-423624 // JVNDB: JVNDB-2022-016040 // NVD: CVE-2022-31774

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202208-1842

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202208-1842

PATCH

title:	6608600 IBM X-Force Exchange	url:	https://www.ibm.com/support/pages/node/6608600	Trust: 0.8
title:	IBM DataPower Gateway Fixes for cross-site scripting vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=202582	Trust: 0.6

sources: JVNDB: JVNDB-2022-016040 // CNNVD: CNNVD-202208-1842

EXTERNAL IDS

db:	NVD	id:	CVE-2022-31774	Trust: 3.4
db:	JVNDB	id:	JVNDB-2022-016040	Trust: 0.8
db:	AUSCERT	id:	ESB-2022.4768	Trust: 0.6
db:	CNNVD	id:	CNNVD-202208-1842	Trust: 0.6
db:	CNVD	id:	CNVD-2022-56972	Trust: 0.1
db:	VULHUB	id:	VHN-423624	Trust: 0.1
db:	VULMON	id:	CVE-2022-31774	Trust: 0.1

sources: VULHUB: VHN-423624 // VULMON: CVE-2022-31774 // JVNDB: JVNDB-2022-016040 // CNNVD: CNNVD-202208-1842 // NVD: CVE-2022-31774

REFERENCES

url:	https://www.ibm.com/support/pages/node/6608600	Trust: 1.8
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/228358	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2022-31774	Trust: 0.8
url:	https://www.auscert.org.au/bulletins/esb-2022.4768	Trust: 0.6
url:	https://vigilance.fr/vulnerability/ibm-datapower-gateway-two-vulnerabilities-39359	Trust: 0.6
url:	https://cxsecurity.com/cveshow/cve-2022-31774/	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-423624 // VULMON: CVE-2022-31774 // JVNDB: JVNDB-2022-016040 // CNNVD: CNNVD-202208-1842 // NVD: CVE-2022-31774

SOURCES

db:	VULHUB	id:	VHN-423624
db:	VULMON	id:	CVE-2022-31774
db:	JVNDB	id:	JVNDB-2022-016040
db:	CNNVD	id:	CNNVD-202208-1842
db:	NVD	id:	CVE-2022-31774

LAST UPDATE DATE

2024-08-14T12:59:17.955000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-423624	date:	2022-08-04T00:00:00
db:	VULMON	id:	CVE-2022-31774	date:	2022-08-01T00:00:00
db:	JVNDB	id:	JVNDB-2022-016040	date:	2023-10-02T01:14:00
db:	CNNVD	id:	CNNVD-202208-1842	date:	2022-09-28T00:00:00
db:	NVD	id:	CVE-2022-31774	date:	2022-08-04T18:33:24.427

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-423624	date:	2022-08-01T00:00:00
db:	VULMON	id:	CVE-2022-31774	date:	2022-08-01T00:00:00
db:	JVNDB	id:	JVNDB-2022-016040	date:	2023-10-02T00:00:00
db:	CNNVD	id:	CNNVD-202208-1842	date:	2022-08-01T00:00:00
db:	NVD	id:	CVE-2022-31774	date:	2022-08-01T11:15:13.680