PT-2022-15364 · Ibm · Ibm Datapower Gateway

Published 2022-07-31 · Updated 2022-08-04 · CVE-2022-22326

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

A:N/S:U/AC:L/I:N/C:L/AV:L/UI:N/PR:N

Name of the Vulnerable Software and Affected Versions IBM Datapower Gateway versions 10.0.1.0 through 10.0.1.5 IBM Datapower Gateway versions 10.0.2.0 through 10.0.4.0 IBM Datapower Gateway versions 2018.4.1.0 through 2018.4.1.18

Description The issue is related to insufficient authorization checks, which could allow unauthorized viewing of logs and files.

Recommendations For versions 10.0.1.0 through 10.0.1.5, update to a version that includes sufficient authorization checks. For versions 10.0.2.0 through 10.0.4.0, update to a version that includes sufficient authorization checks. For versions 2018.4.1.0 through 2018.4.1.18, update to a version that includes sufficient authorization checks.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-22326

Affected Products

Ibm Datapower Gateway

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-22326 · Security Note
• https://ibm.com/support/pages/node/6560048 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/218856 · Vendor Advisory
• https://ibm.com/support/pages/node/6608598 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22326 · Vendor Advisory
• https://t.me/cvenotify/34067 · Telegram Post