PT-2023-1550 · Ibm · Ibm App Connect Enterprise

CVE-2022-42439 · Publicado 2023-01-31 · Atualizado 2023-07-06

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise versions 11.0.0.17 through 11.0.0.19 IBM App Connect Enterprise versions 12.0.4.0 and 12.0.5.0

Description The issue is related to a lack of protection for service data in the Discovery component of the App Connect Enterprise Certified Container. This may allow a remote attacker to disclose protected information. Specifically, the vulnerability in the Discovery Connector nodes could cause a 3rd party system's credentials to be exposed to a privileged attacker.

Recommendations For IBM App Connect Enterprise versions 11.0.0.17 through 11.0.0.19, consider restricting access to the Discovery Connector nodes to minimize the risk of credential exposure. For IBM App Connect Enterprise versions 12.0.4.0 and 12.0.5.0, consider implementing additional security measures to protect 3rd party system credentials. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Insertion into Log File

Enumeração de Fraquezas

CWE-200

CWE-532

Identificadores relacionados

BDU:2023-01006

CVE-2022-42439

Produtos afetados

Ibm App Connect Enterprise

Referências · 6

• https://t.me/cibsecurity/57628 · Publicação no Telegram
• https://exchange.xforce.ibmcloud.com/vulnerabilities/238211 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2022-42439 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2022-42439 · Nota de Segurança
• https://ibm.com/support/pages/node/6952435 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-01006 · Nota de Segurança