Lucene search

K
cve[email protected]CVE-2022-43928
HistoryApr 07, 2023 - 2:15 p.m.

CVE-2022-43928

2023-04-0714:15:07
web.nvd.nist.gov
69
ibm
toolbox for java
db2 mirror
vulnerability
sensitive information
exposure
java
ibm x-force
nvd
cve-2022-43928

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.2%

The IBM Toolbox for Java (Db2 Mirror for i 7.4 and 7.5) could allow a user to obtain sensitive information, caused by utilizing a Java string for processing. Since Java strings are immutable, their contents exist in memory until garbage collected. This means sensitive data could be visible in memory over an indefinite amount of time. IBM has addressed this issue by reducing the amount of time the sensitive data is visible in memory. IBM X-Force ID: 241675.

Affected configurations

Vulners
NVD
Node
ibmdb2_mirror_for_iMatch7.4
OR
ibmdb2_mirror_for_iMatch7.5
VendorProductVersionCPE
ibmdb2_mirror_for_i7.4cpe:2.3:a:ibm:db2_mirror_for_i:7.4:*:*:*:*:*:*:*
ibmdb2_mirror_for_i7.5cpe:2.3:a:ibm:db2_mirror_for_i:7.5:*:*:*:*:*:*:*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Db2 Mirror for i",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "7.4, 7.5"
      }
    ]
  }
]

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

29.2%

Related for CVE-2022-43928