PT-2022-15466 · Ibm · Ibm Spectrum Protect Server+1

Published 2022-06-30 · Updated 2023-08-08 · CVE-2022-22487

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Server versions 8.1.0.000 through 8.1.14

Description A remote attacker could perform a brute force attack by making unlimited attempts to login to the storage agent without locking the administrative ID. This could allow the attacker to gain unauthorized administrative access to both the IBM Spectrum Protect storage agent and the IBM Spectrum Protect Server with which it communicates.

Recommendations For versions 8.1.0.000 through 8.1.14, consider implementing a lockout policy for the administrative ID after a specified number of failed login attempts to mitigate the risk of brute force attacks. As a temporary workaround, restrict access to the storage agent to minimize the risk of exploitation.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2022-22487

Affected Products

Ibm Spectrum Protect Server

Ibm Spectrum Protect Storage Agents

References · 6

• https://ibm.com/support/pages/node/6596881 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22487 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/226326 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22487 · Security Note
• https://t.me/cibsecurity/45427 · Telegram Post
• https://t.me/cvenotify/32440 · Telegram Post