PT-2022-15474 · Ibm · Ibm Spectrum Protect Server

Published 2022-06-30 · Updated 2022-07-08 · CVE-2022-22496

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM Spectrum Protect Server versions 8.1.0.000 through 8.1.14

Description The issue arises when a user account for the IBM Spectrum Protect Server is being established and configured to use SESSIONSECURITY=TRANSITIONAL. In this mode, it may be susceptible to an offline dictionary attack.

Recommendations For versions 8.1.0.000 through 8.1.14, consider disabling the use of SESSIONSECURITY=TRANSITIONAL to prevent potential offline dictionary attacks until a patch is available. Restrict access to user account establishment to minimize the risk of exploitation.

Fix

Improper Restriction of Excessive Authentication Attempts

Weakness Enumeration

CWE-307

Related Identifiers

CVE-2022-22496

Affected Products

Ibm Spectrum Protect Server

References · 7

• https://ibm.com/support/pages/node/6596881 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-22496 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22496 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/226942 · Vendor Advisory
• https://t.me/cvenotify/32796 · Telegram Post
• https://t.me/cibsecurity/45425 · Telegram Post
• https://t.me/cvenotify/32438 · Telegram Post