PT-2023-12690 · Ibm · Ibm Sterling B2B Integrator Standard Edition

Published 2023-01-04 · Updated 2023-01-11 · CVE-2022-22371

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator Standard Edition versions 6.0.0.0 through 6.1.2.1

Description The issue allows an authenticated user to impersonate another user on the system because it does not invalidate the session after a password change.

Recommendations For versions 6.0.0.0 through 6.1.2.1, consider implementing a workaround to manually invalidate sessions after a password change until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2022-22371

Affected Products

Ibm Sterling B2B Integrator Standard Edition

References · 6

• https://ibm.com/support/pages/node/6852461 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/221195 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-22371 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22371 · Vendor Advisory
• https://t.me/cvenotify/41782 · Telegram Post
• https://t.me/cvenotify/41293 · Telegram Post