IBM Sterling External Authentication Server 3.4.3.2, 6.0.2.0, and 6.0.3.0 is vulnerable to path traversals, due to not properly validating RESTAPI configuration data. An authorized user could import invalid data which could be used for an attack. IBM X-Force ID: 220144.
References
| Link | Resource |
|---|---|
| https://exchange.xforce.ibmcloud.com/vulnerabilities/220144 | VDB Entry Vendor Advisory |
| https://www.ibm.com/support/pages/node/6558928 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
02 Mar 2022, 21:14
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 4.0
v3 : 4.3 |
| CPE | cpe:2.3:a:ibm:sterling_external_authentication_server:3.4.3.2:*:*:*:*:*:*:* cpe:2.3:a:ibm:sterling_external_authentication_server:6.0.2.0:*:*:*:*:*:*:* cpe:2.3:a:ibm:sterling_external_authentication_server:6.0.3.0:*:*:*:*:*:*:* |
|
| First Time |
Ibm sterling External Authentication Server
Ibm |
|
| CWE | CWE-22 | |
| References | (CONFIRM) https://www.ibm.com/support/pages/node/6558928 - Patch, Vendor Advisory | |
| References | (XF) https://exchange.xforce.ibmcloud.com/vulnerabilities/220144 - VDB Entry, Vendor Advisory |
24 Feb 2022, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-02-24 17:15
Updated : 2023-12-10 14:22
NVD link : CVE-2022-22349
Mitre link : CVE-2022-22349
CVE.ORG link : CVE-2022-22349
JSON object : View
Products Affected
ibm
- sterling_external_authentication_server
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')