Lucene search

IBM1DED6A0600D2310641894989F7BB44CEE27B04342A02093B773122CBF19E1F9A

HistoryMay 19, 2023 - 5:17 a.m.

Security Bulletin: IBM WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On is vulnerable to spoofing when using Web Server Plug-ins (CVE-2022-39161)

2023-05-1905:17:18

www.ibm.com

ibm

websphere

application server

vulnerability

spoofing

security bulletin

access manager

enterprise single sign-on

cve-2022-39161

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

23.4%

JSON

Summary

Security Bulletin: IBM WebSphere Application Server shipped with IBM Security Access Manager for Enterprise Single Sign-On is vulnerable to spoofing when using Web Server Plug-ins (CVE-2022-39161). This has been addressed in the remediation section below.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s)	Version(s)
IBM Security Access Manager for Enterprise Single-Sign On	8.2.1, 8.2.2

Remediation/Fixes

IBM encourages customers to update their systems promptly.

Principal Product and Version(s)	Affected Supporting Product and Version	Affected Supporting Product Security Bulletin
IBM Security Access Manager for Enterprise Single Sign-On 8.2.1	IBM WebSphere Application Server 8.5	Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to spoofing when using Web Server Plug-ins (CVE-2022-39161)
IBM Security Access Manager for Enterprise Single Sign-On 8.2.2	IBM WebSphere Application Server 8.5	Security Bulletin: IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to spoofing when using Web Server Plug-ins (CVE-2022-39161)

Workarounds and Mitigations

None

Affected configurations

Vulners

Node

ibmsecurity_access_manager_for_enterprise_single_sign-onMatch8.2.1

ibmsecurity_access_manager_for_enterprise_single_sign-onMatch8.2.2

CPENameOperatorVersion
ibm security access manager for enterprise single sign-oneq8.2.1
ibm security access manager for enterprise single sign-oneq8.2.2

CPE	Name	Operator	Version
	ibm security access manager for enterprise single sign-on	eq	8.2.1
	ibm security access manager for enterprise single sign-on	eq	8.2.2

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

23.4%

JSON

Related for 1DED6A0600D2310641894989F7BB44CEE27B04342A02093B773122CBF19E1F9A