Lucene search

IbmCVELIST:CVE-2022-43872

HistoryDec 20, 2022 - 6:35 p.m.

CVE-2022-43872 IBM Financial Transaction Manager information disclosure

2022-12-2018:35:34

ibm

www.cve.org

ibm ftm

information disclosure

authorization checks

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.1%

JSON

IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical information (e.g. event log entries) about the FTM SWIFT system. IBM X-Force ID: 239708.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Financial Transaction Manager",
    "vendor": "IBM",
    "versions": [
      {
        "status": "affected",
        "version": "3.2.4"
      }
    ]
  }
]

References

exchange.xforce.ibmcloud.com/vulnerabilities/239708

www.ibm.com/support/pages/node/6848881

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.2 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

26.1%

JSON

Related for CVELIST:CVE-2022-43872