SecuriTricks - CVE-2022-43916

Description

IBM App Connect Enterprise Certified Container 7.1, 7.2, 8.0, 8.1, 8.2, 9.0, 9.1, 9.2, 10.0, 10.1, 11.0, 11.1, 11.2, 11.3, 11.4, 11.5, 11.6, 12.0, 12.1, 12.2, 12.3, 12.4, 12.5, 12.6, and 12.7 Pods do not restrict network egress for Pods that are used for internal infrastructure.

Product(s) Impacted

Product	Versions
IBM App Connect Enterprise Certified Container	['7.1', '7.2', '8.0', '8.1', '8.2', '9.0', '9.1', '9.2', '10.0', '10.1', '11.0', '11.1', '11.2', '11.3', '11.4', '11.5', '11.6', '12.0', '12.1', '12.2', '12.3', '12.4', '12.5', '12.6', '12.7']

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

CWE-923

Improper Restriction of Communication Channel to Intended Endpoints

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.

References

https://www.ibm.com/support/pages/node/7181916

CVSS Score

6.8 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: HIGH
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: HIGH
Availability Impact: NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

View Vector String

Timeline

Published: Jan. 30, 2025, 12:15 p.m.
Last Modified: Feb. 18, 2025, 7:15 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

psirt@us.ibm.com

CVE-2022-43916