CVE-2022-22318

IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system.

CVSS v3 9.8 CRITICAL
CVSS v2.0 6.5 MEDIUM

9.8^/10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/218283	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/6596049	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/218283	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/6596049	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:curam_social_program_management:8.0.0:::::::*
	cpe:2.3:a:ibm:curam_social_program_management:8.0.1:::::::*

OR	cpe:2.3:o:hp:hp-ux:-:::::::*
	cpe:2.3:o:ibm:aix:-:::::::*
	cpe:2.3:o:ibm:z\/os:-:::::::*
	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*
	cpe:2.3:o:oracle:solaris:-::::::-:

History

21 Nov 2024, 06:46

Type	Values Removed	Values Added
References	~~() https://exchange.xforce.ibmcloud.com/vulnerabilities/218283 - VDB Entry, Vendor Advisory~~	() https://exchange.xforce.ibmcloud.com/vulnerabilities/218283 - VDB Entry, Vendor Advisory
References	~~() https://www.ibm.com/support/pages/node/6596049 - Patch, Vendor Advisory~~	() https://www.ibm.com/support/pages/node/6596049 - Patch, Vendor Advisory

28 Jun 2022, 12:22

Type	Values Removed	Values Added
CWE		CWE-613
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 6.5 v3 : 9.8
References	~~(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/218283 -~~	(XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/218283 - VDB Entry, Vendor Advisory
References	~~(CONFIRM) https://www.ibm.com/support/pages/node/6596049 -~~	(CONFIRM) https://www.ibm.com/support/pages/node/6596049 - Patch, Vendor Advisory
CPE		cpe:2.3:o:linux:linux_kernel:-:::::::* cpe:2.3:o:oracle:solaris:-::::::-: cpe:2.3:o:microsoft:windows:-:::::::* cpe:2.3:o:ibm:aix:-:::::::* cpe:2.3:o:hp:hp-ux:-:::::::* cpe:2.3:a:ibm:curam_social_program_management:8.0.1:::::::* cpe:2.3:a:ibm:curam_social_program_management:8.0.0:::::::* cpe:2.3:o:ibm:z\/os:-:::::::*

20 Jun 2022, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-06-20 17:15

Updated : 2024-11-21 06:46

NVD link : CVE-2022-22318

Mitre link : CVE-2022-22318

CVE.ORG link : CVE-2022-22318

JSON object : View

Products Affected

ibm

aix
curam_social_program_management
z\/os

oracle

solaris

hp-ux

microsoft

windows

linux

linux_kernel

CWE

CWE-613

Insufficient Session Expiration

{"id": "CVE-2022-22318", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.5}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2022-06-20T17:15:08.613", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/218283", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/6596049", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/218283", "tags": ["VDB Entry", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.ibm.com/support/pages/node/6596049", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-613"}]}], "descriptions": [{"lang": "en", "value": "IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the system."}, {"lang": "es", "value": "IBM Curam Social Program Management versiones 8.0.0 y 8.0.1, no invalida la sesi\u00f3n tras el cierre de sesi\u00f3n, lo que podr\u00eda permitir a un usuario autenticado hacerse pasar por otro usuario en el sistema"}], "lastModified": "2024-11-21T06:46:37.923", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:curam_social_program_management:8.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "134AEBD8-7BF5-4C5E-8231-D01A68D3BA6F"}, {"criteria": "cpe:2.3:a:ibm:curam_social_program_management:8.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7613A179-35F1-4943-8D0C-0BD34AA2592E"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:hp:hp-ux:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F480AA32-841A-4E68-9343-B2E7548B0A0C"}, {"criteria": "cpe:2.3:o:ibm:aix:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "E492C463-D76E-49B7-A4D4-3B499E422D89"}, {"criteria": "cpe:2.3:o:ibm:z\\/os:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0E97A964-6F9E-4C87-9B90-21AE2C1DF52F"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}, {"criteria": "cpe:2.3:o:oracle:solaris:-:*:*:*:*:*:-:*", "vulnerable": false, "matchCriteriaId": "F5027746-8216-452D-83C5-2F8E9546F2A5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}

9.8 /10