Details of VAR-202208-0105

ID

VAR-202208-0105

CVE

CVE-2022-32750

TITLE

IBM DataPower Gateway Cross-site scripting vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-016237

DESCRIPTION

IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 228435. Vendor exploits this vulnerability IBM X-Force ID: 228435 It is published as.Information may be obtained and information may be tampered with

Trust: 1.8

sources: NVD: CVE-2022-32750 // JVNDB: JVNDB-2022-016237 // VULHUB: VHN-424820 // VULMON: CVE-2022-32750

AFFECTED PRODUCTS

vendor:	ibm	model:	datapower gateway	scope:	eq	version:	10.5.0.0	Trust: 1.8
vendor:	ibm	model:	datapower gateway	scope:	gte	version:	10.0.1.0	Trust: 1.0
vendor:	ibm	model:	datapower gateway	scope:	lt	version:	10.5.0.1	Trust: 1.0
vendor:	ibm	model:	datapower gateway	scope:	gte	version:	2018.4.1.0	Trust: 1.0
vendor:	ibm	model:	datapower gateway	scope:	gte	version:	10.0.2.0	Trust: 1.0
vendor:	ibm	model:	datapower gateway	scope:	lte	version:	2018.4.1.21	Trust: 1.0
vendor:	ibm	model:	datapower gateway	scope:	lte	version:	10.0.1.8	Trust: 1.0
vendor:	ibm	model:	datapower gateway	scope:	eq	version:	10.0.1.0 to 10.0.1.8	Trust: 0.8
vendor:	ibm	model:	datapower gateway	scope:	eq	version:	2018.4.1.0 to 2018.4.1.21	Trust: 0.8
vendor:	ibm	model:	datapower gateway	scope:	eq	version:	-	Trust: 0.8
vendor:	ibm	model:	datapower gateway	scope:	eq	version:	10.0.2.0 to 10.0.4.0	Trust: 0.8

sources: JVNDB: JVNDB-2022-016237 // NVD: CVE-2022-32750

CVSS

SEVERITY

CVSSV2

CVSSV3

psirt@us.ibm.com:	CVE-2022-32750
value:	MEDIUM
Trust: 1.0
nvd@nist.gov:	CVE-2022-32750
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2022-32750
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-202208-1844
value:	MEDIUM
Trust: 0.6

psirt@us.ibm.com:	CVE-2022-32750
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.3
impactScore:	2.7
version:	3.0
Trust: 1.8
nvd@nist.gov:	CVE-2022-32750
baseSeverity:	MEDIUM
baseScore:	5.4
vectorString:	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.3
impactScore:	2.7
version:	3.1
Trust: 1.0

sources: JVNDB: JVNDB-2022-016237 // CNNVD: CNNVD-202208-1844 // NVD: CVE-2022-32750 // NVD: CVE-2022-32750

PROBLEMTYPE DATA

problemtype:	CWE-79	Trust: 1.1
problemtype:	Cross-site scripting (CWE-79) [NVD evaluation ]	Trust: 0.8

sources: VULHUB: VHN-424820 // JVNDB: JVNDB-2022-016237 // NVD: CVE-2022-32750

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202208-1844

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202208-1844

PATCH

title:	6608600 IBM X-Force Exchange	url:	https://www.ibm.com/support/pages/node/6608600	Trust: 0.8
title:	IBM DataPower Gateway Fixes for cross-site scripting vulnerabilities	url:	http://123.124.177.30/web/xxk/bdxqById.tag?id=202764	Trust: 0.6

sources: JVNDB: JVNDB-2022-016237 // CNNVD: CNNVD-202208-1844

EXTERNAL IDS

db:	NVD	id:	CVE-2022-32750	Trust: 3.4
db:	JVNDB	id:	JVNDB-2022-016237	Trust: 0.8
db:	CNNVD	id:	CNNVD-202208-1844	Trust: 0.6
db:	VULHUB	id:	VHN-424820	Trust: 0.1
db:	VULMON	id:	CVE-2022-32750	Trust: 0.1

sources: VULHUB: VHN-424820 // VULMON: CVE-2022-32750 // JVNDB: JVNDB-2022-016237 // CNNVD: CNNVD-202208-1844 // NVD: CVE-2022-32750

REFERENCES

url:	https://www.ibm.com/support/pages/node/6608600	Trust: 1.8
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/228435	Trust: 1.8
url:	https://nvd.nist.gov/vuln/detail/cve-2022-32750	Trust: 0.8
url:	https://vigilance.fr/vulnerability/ibm-datapower-gateway-two-vulnerabilities-39359	Trust: 0.6
url:	https://cxsecurity.com/cveshow/cve-2022-32750/	Trust: 0.6
url:	https://nvd.nist.gov	Trust: 0.1

sources: VULHUB: VHN-424820 // VULMON: CVE-2022-32750 // JVNDB: JVNDB-2022-016237 // CNNVD: CNNVD-202208-1844 // NVD: CVE-2022-32750

SOURCES

db:	VULHUB	id:	VHN-424820
db:	VULMON	id:	CVE-2022-32750
db:	JVNDB	id:	JVNDB-2022-016237
db:	CNNVD	id:	CNNVD-202208-1844
db:	NVD	id:	CVE-2022-32750

LAST UPDATE DATE

2024-08-14T14:02:29.718000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-424820	date:	2022-08-05T00:00:00
db:	VULMON	id:	CVE-2022-32750	date:	2022-08-01T00:00:00
db:	JVNDB	id:	JVNDB-2022-016237	date:	2023-10-03T06:06:00
db:	CNNVD	id:	CNNVD-202208-1844	date:	2022-09-27T00:00:00
db:	NVD	id:	CVE-2022-32750	date:	2022-08-05T03:33:24.233

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-424820	date:	2022-08-01T00:00:00
db:	VULMON	id:	CVE-2022-32750	date:	2022-08-01T00:00:00
db:	JVNDB	id:	JVNDB-2022-016237	date:	2023-10-03T00:00:00
db:	CNNVD	id:	CNNVD-202208-1844	date:	2022-08-01T00:00:00
db:	NVD	id:	CVE-2022-32750	date:	2022-08-01T11:15:13.857