PT-2022-7106 · Ibm · Ibm Navigator For I

Amine Ismail + 1 · Published 2022-12-22 · Updated 2022-12-28 · CVE-2022-43859

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions IBM Navigator for i versions 7.3 through 7.5

Description The issue is related to the lack of protection for the SQL query structure in the IBM Navigator graphical interface of the IBM i operating system. This could allow a remote attacker to gain unauthorized access to protected information. By performing a UNION-based SQL injection, an attacker could see file permissions through this interface.

Recommendations For IBM Navigator for i versions 7.3 through 7.5, consider restricting access to the interface until a patch is available. As a temporary workaround, avoid using the interface for sensitive operations. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-07589

CVE-2022-43859

Affected Products

Ibm Navigator For I

References · 7

• https://osv.dev/vulnerability/CVE-2022-43859 · Vendor Advisory
• https://ibm.com/support/pages/node/6850801 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07589 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-43859 · Security Note
• https://t.me/cvenotify/40899 · Telegram Post
• https://t.me/cibsecurity/55196 · Telegram Post
• https://exchange.xforce.ibmcloud.com/vulnerabilities/239304 · Note