PT-2022-25511 · Ibm · Ibm Urbancode Deploy

Chris Haller + 1 · Published 2022-11-17 · Updated 2022-11-18 · CVE-2022-40751

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM UrbanCode Deploy versions 6.2.7.0 through 6.2.7.17 IBM UrbanCode Deploy versions 7.0.0.0 through 7.0.5.12 IBM UrbanCode Deploy versions 7.1.0.0 through 7.1.2.8 IBM UrbanCode Deploy versions 7.2.0.0 through 7.2.3.1

Description The issue allows a user with administrative privileges, including "Manage Security" permissions, to potentially recover a credential previously saved for performing authenticated LDAP searches.

Recommendations For versions 6.2.7.0 through 6.2.7.17, update to a version outside of this range to resolve the issue. For versions 7.0.0.0 through 7.0.5.12, update to a version outside of this range to resolve the issue. For versions 7.1.0.0 through 7.1.2.8, update to a version outside of this range to resolve the issue. For versions 7.2.0.0 through 7.2.3.1, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to administrative privileges, including "Manage Security" permissions, until a patch is available.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2022-40751

Affected Products

Ibm Urbancode Deploy

References · 5

• https://osv.dev/vulnerability/CVE-2022-40751 · Vendor Advisory
• https://ibm.com/support/pages/node/6831907 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/236601 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40751 · Security Note
• https://t.me/cibsecurity/53084 · Telegram Post