PT-2022-25296 · Ibm · Ibm Datapower Gateway

Published 2022-11-22 · Updated 2022-11-26 · CVE-2022-40228

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 10.0.1.0 through 10.0.1.9 IBM DataPower Gateway versions 10.0.3.0 through 10.0.4.0 IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.22 IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.2

Description The issue arises because the system does not invalidate session after a password change, which could allow an authenticated user to impersonate another user on the system.

Recommendations For IBM DataPower Gateway versions 10.0.1.0 through 10.0.1.9, update to a version that includes the session invalidation fix after a password change. For IBM DataPower Gateway versions 10.0.3.0 through 10.0.4.0, update to a version that includes the session invalidation fix after a password change. For IBM DataPower Gateway versions 2018.4.1.0 through 2018.4.1.22, update to a version that includes the session invalidation fix after a password change. For IBM DataPower Gateway versions 10.5.0.0 through 10.5.0.2, update to a version that includes the session invalidation fix after a password change. As a temporary workaround, consider implementing additional authentication checks to minimize the risk of impersonation until a patch is available.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2022-40228

Affected Products

Ibm Datapower Gateway

References · 6

• https://osv.dev/vulnerability/CVE-2022-40228 · Vendor Advisory
• https://ibm.com/support/pages/node/6840759 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/235527 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40228 · Security Note
• https://t.me/cibsecurity/53370 · Telegram Post
• https://t.me/cvenotify/38259 · Telegram Post