IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not properly validating RESTAPI configuration data. An authorized user could import invalid data which could be used for an attack. IBM X-Force ID: 220144.
References
| Link | Resource |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/220144 | VDB Entry Vendor Advisory |
| https://www.ibm.com/support/pages/node/6558928 | Patch Vendor Advisory |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/220144 | VDB Entry Vendor Advisory |
| https://www.ibm.com/support/pages/node/6558928 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 06:46
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://exchange.xforce.ibmcloud.com/vulnerabilities/220144 - VDB Entry, Vendor Advisory | |
| References | () https://www.ibm.com/support/pages/node/6558928 - Patch, Vendor Advisory |
02 Mar 2022, 21:14
| Type | Values Removed | Values Added |
|---|---|---|
| References | (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/220144 - VDB Entry, Vendor Advisory | |
| References | (CONFIRM) https://www.ibm.com/support/pages/node/6558928 - Patch, Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 4.3 |
| CWE | CWE-22 | |
| CPE | cpe:2.3:a:ibm:sterling_external_authentication_server:6.0.2.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:sterling_external_authentication_server:3.4.3.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:sterling_external_authentication_server:6.0.3.0:*:*:*:*:*:*:* |
24 Feb 2022, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-02-24 17:15
Updated : 2024-11-21 06:46
NVD link : CVE-2022-22349
Mitre link : CVE-2022-22349
CVE.ORG link : CVE-2022-22349
JSON object : View
Products Affected
ibm
- sterling_external_authentication_server
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')