PT-2022-15393 · Ibm · Ibm Urbancode Deploy

Published 2022-07-01 · Updated 2022-07-08 · CVE-2022-22366

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

C:H/UI:N/I:N/A:N/AV:N/PR:H/AC:L/S:U

Name of the Vulnerable Software and Affected Versions IBM UrbanCode Deploy versions 6.2.7.15, 7.0.5.10, 7.1.2.6, and 7.2.2.1

Description The issue concerns the storage of user credentials in plain clear text, allowing a local user to read them.

Recommendations For versions 6.2.7.15, 7.0.5.10, 7.1.2.6, and 7.2.2.1, consider restricting local user access to minimize the risk of exploitation until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Cleartext Storage of Sensitive Information

Weakness Enumeration

CWE-312

Related Identifiers

CVE-2022-22366

Affected Products

Ibm Urbancode Deploy

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/221006 · Vendor Advisory
• https://ibm.com/support/pages/node/6600065 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22366 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22366 · Security Note