PT-2022-15385 · Ibm · Ibm Spectrum Protect Plus+1

Published 2022-03-14 · Updated 2022-03-22 · CVE-2022-22354

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Plus versions 10.1.0.0 through 10.1.9.2 IBM Spectrum Copy Data Management versions 2.2.0.0 through 2.2.14.3

Description The issue is related to a Slowloris HTTP denial of service attack. This attack can take place because the software does not limit the length of a connection, which can cause the Admin Console to become unresponsive.

Recommendations For IBM Spectrum Protect Plus versions 10.1.0.0 through 10.1.9.2, consider restricting access to the Admin Console to minimize the risk of exploitation. For IBM Spectrum Copy Data Management versions 2.2.0.0 through 2.2.14.3, consider implementing connection limits to prevent Slowloris HTTP denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2022-22354

Affected Products

Ibm Spectrum Copy Data Management

Ibm Spectrum Protect Plus

References · 6

• https://exchange.xforce.ibmcloud.com/vulnerabilities/220485 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22354 · Vendor Advisory
• https://ibm.com/support/pages/node/6562479 · Vendor Advisory
• https://ibm.com/support/pages/node/6562989 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22354 · Security Note
• https://t.me/cibsecurity/38893 · Telegram Post