CVE-2022-40228

🗓️ 22 Nov 2022 18:52:13Reported by ibmType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 89 Views

IBM DataPower Gateway versions 10.0.3.0 to 10.0.4.0, 10.0.1.0 to 10.0.1.9, 2018.4.1.0 to 2018.4.1.22, and 10.5.0.0 to 10.5.0.2 does not invalidate session after password change, allowing authenticated user impersonation

Reporter	Title	Published	Views	Family All 12
IBM Security Bulletins	Security Bulletin: IBM DataPower Gateway does not invalidate active sessions on a password change (CVE-2022-40228)	26 Mar 202502:42	–	ibm
Circl	CVE-2022-40228	22 Nov 202222:13	–	circl
CNNVD	IBM DataPower Gateway 代码问题漏洞	22 Nov 202200:00	–	cnnvd
Cvelist	CVE-2022-40228 IBM DataPower Gateway session fixation	22 Nov 202218:52	–	cvelist
EUVD	EUVD-2022-43526	3 Oct 202520:07	–	euvd
NVD	CVE-2022-40228	22 Nov 202219:15	–	nvd
OSV	CVE-2022-40228	22 Nov 202219:15	–	osv
Prion	Session fixation	22 Nov 202219:15	–	prion
Positive Technologies	PT-2022-25296 · Ibm · Ibm Datapower Gateway	22 Nov 202200:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2022-40228: Insufficient Session Expiration	22 Nov 202200:00	–	rapid7

NVD

Vulners

Node

ibm datapower_gatewayRange10.0.1.0–10.0.1.9

ibm datapower_gatewayRange10.0.3.0–10.0.4.0

ibm datapower_gatewayRange10.5.0.0–10.5.0.2

ibm datapower_gatewayRange2018.4.1.0–2018.4.1.22

[
  {
    "defaultStatus": "unaffected",
    "product": "DataPower Gateway",
    "vendor": "IBM",
    "versions": [
      {
        "lessThan": "10.0.4.0",
        "status": "affected",
        "version": "10.0.3.0",
        "versionType": "semver"
      },
      {
        "lessThan": "10.0.1.9",
        "status": "affected",
        "version": "10.0.1.0",
        "versionType": "semver"
      },
      {
        "lessThan": "2018.4.1.22",
        "status": "affected",
        "version": "2018.4.1.0",
        "versionType": "semver"
      },
      {
        "lessThan": "10.5.0.2",
        "status": "affected",
        "version": "10.5.0.0",
        "versionType": "semver"
      }
    ]
  }
]