Sign-up

ID

VAR-202209-0758


CVE

CVE-2022-34336


TITLE

IBM  of  IBM WebSphere Application Server  Cross-site scripting vulnerability in

Trust: 0.8

sources: JVNDB: JVNDB-2022-018020

DESCRIPTION

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 229714. This product is a platform for JavaEE and Web service applications and the foundation of the IBM WebSphere software platform

Trust: 2.16

sources: NVD: CVE-2022-34336 // JVNDB: JVNDB-2022-018020 // CNVD: CNVD-2022-83582

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2022-83582

AFFECTED PRODUCTS

vendor:ibmmodel:websphere application serverscope:eqversion:8.5

Trust: 2.4

vendor:ibmmodel:websphere application serverscope:eqversion:8.0

Trust: 2.4

vendor:ibmmodel:websphere application serverscope:eqversion:7.0

Trust: 2.4

vendor:ibmmodel:websphere application serverscope:eqversion:9.0

Trust: 2.4

vendor:ibmmodel:websphere application serverscope:eqversion: -

Trust: 0.8

sources: CNVD: CNVD-2022-83582 // JVNDB: JVNDB-2022-018020 // NVD: CVE-2022-34336

CVSS

SEVERITY

CVSSV2

CVSSV3

psirt@us.ibm.com: CVE-2022-34336
value: MEDIUM

Trust: 1.0

nvd@nist.gov: CVE-2022-34336
value: MEDIUM

Trust: 1.0

NVD: CVE-2022-34336
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2022-83582
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202209-772
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2022-83582
severity: MEDIUM
baseScore: 5.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

psirt@us.ibm.com: CVE-2022-34336
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.3
impactScore: 2.7
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2022-34336
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.3
impactScore: 2.7
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2022-83582 // JVNDB: JVNDB-2022-018020 // CNNVD: CNNVD-202209-772 // NVD: CVE-2022-34336 // NVD: CVE-2022-34336

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.0

problemtype:Cross-site scripting (CWE-79) [NVD evaluation ]

Trust: 0.8

sources: JVNDB: JVNDB-2022-018020 // NVD: CVE-2022-34336

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202209-772

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-202209-772

PATCH

title:6619699 IBM X-Force Exchangeurl:https://www.ibm.com/support/pages/node/6619699

Trust: 0.8

title:Patch for IBM WebSphere Application Server Cross-Site Scripting Vulnerability (CNVD-2022-83582)url:https://www.cnvd.org.cn/patchInfo/show/362351

Trust: 0.6

title:IBM WebSphere Application Server Fixes for cross-site scripting vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=208109

Trust: 0.6

sources: CNVD: CNVD-2022-83582 // JVNDB: JVNDB-2022-018020 // CNNVD: CNNVD-202209-772

EXTERNAL IDS

db:NVDid:CVE-2022-34336

Trust: 3.8

db:JVNDBid:JVNDB-2022-018020

Trust: 0.8

db:CNVDid:CNVD-2022-83582

Trust: 0.6

db:AUSCERTid:ESB-2022.4529

Trust: 0.6

db:AUSCERTid:ESB-2022.4856

Trust: 0.6

db:CNNVDid:CNNVD-202209-772

Trust: 0.6

sources: CNVD: CNVD-2022-83582 // JVNDB: JVNDB-2022-018020 // CNNVD: CNNVD-202209-772 // NVD: CVE-2022-34336

REFERENCES

url:https://www.ibm.com/support/pages/node/6619699

Trust: 2.2

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/229714

Trust: 2.2

url:https://nvd.nist.gov/vuln/detail/cve-2022-34336

Trust: 0.8

url:https://www.auscert.org.au/bulletins/esb-2022.4856

Trust: 0.6

url:https://vigilance.fr/vulnerability/websphere-as-cross-site-scripting-via-admin-console-39248

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2022.4529

Trust: 0.6

url:https://cxsecurity.com/cveshow/cve-2022-34336/

Trust: 0.6

sources: CNVD: CNVD-2022-83582 // JVNDB: JVNDB-2022-018020 // CNNVD: CNNVD-202209-772 // NVD: CVE-2022-34336

SOURCES

db:CNVDid:CNVD-2022-83582
db:JVNDBid:JVNDB-2022-018020
db:CNNVDid:CNNVD-202209-772
db:NVDid:CVE-2022-34336

LAST UPDATE DATE

2024-08-14T13:53:02.915000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2022-83582date:2022-12-01T00:00:00
db:JVNDBid:JVNDB-2022-018020date:2023-10-18T06:30:00
db:CNNVDid:CNNVD-202209-772date:2022-09-30T00:00:00
db:NVDid:CVE-2022-34336date:2022-09-16T02:56:17.013

SOURCES RELEASE DATE

db:CNVDid:CNVD-2022-83582date:2022-12-01T00:00:00
db:JVNDBid:JVNDB-2022-018020date:2023-10-18T00:00:00
db:CNNVDid:CNNVD-202209-772date:2022-09-12T00:00:00
db:NVDid:CVE-2022-34336date:2022-09-13T21:15:09.173