PT-2022-15440 · Ibm · Ibm Security Verify Identity Manager

Ben Goodspeed + 8 · Published 2022-07-14 · Updated 2022-07-20 · CVE-2022-22450

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM Security Verify Identity Manager version 10.0

Description The issue allows a privileged user to upload a malicious file by bypassing extension security in an HTTP request.

Recommendations For IBM Security Verify Identity Manager version 10.0, consider restricting file uploads or implementing additional security checks to prevent malicious file uploads until a patch is available. As a temporary workaround, consider disabling file upload functionality to minimize the risk of exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-22450

Affected Products

Ibm Security Verify Identity Manager

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2022-22450 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/224916 · Vendor Advisory
• https://ibm.com/support/pages/node/6603405 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22450 · Vendor Advisory
• https://t.me/cibsecurity/46273 · Telegram Post
• https://t.me/cvenotify/33089 · Telegram Post