PT-2022-22136 · Ibm · Ibm Sterling Partner Engagement Manager

Published 2022-10-10 · Updated 2022-10-12 · CVE-2022-34334

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM Sterling Partner Engagement Manager version 2.0

Description The issue allows an authenticated user to impersonate another user on the system because it does not invalidate the session after logout.

Recommendations For IBM Sterling Partner Engagement Manager version 2.0, manually invalidate the session after logout to prevent impersonation until a patch is available.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2022-34334

Affected Products

Ibm Sterling Partner Engagement Manager

References · 4

• https://osv.dev/vulnerability/CVE-2022-34334 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/229704 · Vendor Advisory
• https://ibm.com/support/pages/node/6828097 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34334 · Security Note