Lucene search

K
cvelistIbmCVELIST:CVE-2022-38382
HistoryAug 13, 2024 - 1:01 a.m.

CVE-2022-38382 IBM Cloud Pak for Security session fixation

2024-08-1301:01:33
CWE-613
ibm
www.cve.org
2
ibm cloud pak
qradar suite
session fixation

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

EPSS

0

Percentile

13.8%

IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.23.0 does not invalidate session after logout which could allow another user to obtain sensitive information. IBM X-Force ID: 233672.

CNA Affected

[
  {
    "cpes": [
      "cpe:2.3:a:ibm:qradar_suite:1.10.12.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:qradar_suite:1.10.23.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cloud_pak_for_security:1.10.0.0:*:*:*:*:*:*:*",
      "cpe:2.3:a:ibm:cloud_pak_for_security:1.10.11.0:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "QRadar Suite Software",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "1.10.23.0",
        "status": "affected",
        "version": "1.10.12.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Cloud Pak for Security",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "1.10.11.0",
        "status": "affected",
        "version": "1.10.0.0",
        "versionType": "semver"
      }
    ]
  }
]

CVSS3

4.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N

EPSS

0

Percentile

13.8%

Related for CVELIST:CVE-2022-38382