Security Bulletin: IBM Sterling B2B Integrator vulnerable to security bypass due to Apache Commons BCEL (CVE-2022-42920)

2024-04-1122:28:27

www.ibm.com

ibm sterling b2b integrator

security bypass

apache commons bcel

vulnerability

cve-2022-42920

out-of-bounds write

remote attacker

control

cvss

versions

remediation

it44322

fix central

entitled registry

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.019

Percentile

88.8%

JSON

Summary

IBM Sterling B2B Integrator uses Apache Commons BCEL. This bulletin identifies the steps to take to address the vulnerability.

Vulnerability Details

CVEID:CVE-2022-42920
**DESCRIPTION:**Apache Commons BCEL could allow a remote attacker to bypass security restrictions, caused by an out-of-bounds write flaw in the APIs. By sending a specially-crafted request, an attacker could exploit this vulnerability to gain control over the resulting bytecode than otherwise expected.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/239562 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Sterling B2B Integrator	6.0.0.0 - 6.0.3.9
IBM Sterling B2B Integrator	6.1.0.0 - 6.1.2.3
IBM Sterling B2B Integrator	6.2.0.0

Remediation/Fixes

IBM strongly recommends addressing the vulnerability now.

Product	Version	APAR	Remediation & Fix
IBM Sterling B2B Integrator	6.0.0.0 - 6.0.3.9	IT44322	Apply B2BI 6.1.2.5 or 6.2.0.1
IBM Sterling B2B Integrator	6.1.0.0 - 6.1.2.3	IT44322	Apply B2BI 6.1.2.5 or 6.2.0.1
IBM Sterling B2B Integrator	6.2.0.0	IT44322	Apply B2BI 6.2.0.1