PT-2024-11667 · Ibm · Ibm App Connect Enterprise Certified Container

Published 2024-08-24 · Updated 2024-09-21 · CVE-2022-43915

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise Certified Container versions 5.0 through 12.1

Description The issue allows a user with privileged access to execute commands in a running Pod, potentially elevating their user privileges due to the lack of limitation on calls to unshare in running Pods.

Recommendations For IBM App Connect Enterprise Certified Container versions 5.0 through 12.1, upgrade the affected component to a version that mitigates the risk.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2022-43915

Affected Products

Ibm App Connect Enterprise Certified Container

References · 10

• https://osv.dev/vulnerability/CVE-2022-43915 · Vendor Advisory
• https://ibm.com/support/pages/node/7166463 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-43915 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/241037 · Vendor Advisory
• https://twitter.com/oktsec/status/1827378899790987568 · Twitter Post
• https://t.me/cvedetector/4057 · Telegram Post
• https://t.me/cvenotify/92044 · Telegram Post
• https://twitter.com/cracbot/status/1828673984269095407 · Twitter Post
• https://t.me/cvenotify/95574 · Telegram Post
• https://twitter.com/CVEnew/status/1827309419199094906 · Twitter Post