IBM1F6964F24244FE65E2F9A76E25A920A178BFA112DC45FD6C5830AB7CBF407E60Security Bulletin: IBM Tivoli Netcool Impact is vulnerable to arbitrary code execution due to Scala (CVE-2022-36944)
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
81.1%
Summary
Scala is used by IBM Tivoli Netcool Impact as part of the Kafka data source and service components. IBM Tivoli Netcool Impact has addressed the applicable CVE.
Vulnerability Details
CVEID:CVE-2022-36944
**DESCRIPTION:**Scala could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization in LazyList. By sending specially-crafted request using gadget chain, an attacker could exploit this vulnerability to execute arbitrary code, erase contents of arbitrary files or make network connections.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/237018 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected Products and Versions
| Affected Product(s) | Version(s) |
|---|---|
| IBM Tivoli Netcool Impact | 7.1.0 |
Remediation/Fixes
** IBM strongly recommends addressing the vulnerability now.**
| Product | VRMF | APAR | Remediation |
|---|---|---|---|
| IBM Tivoli Netcool Impact 7.1.0 | 7.1.0.24 - 7.1.0.27 | IJ44162 | Upgrade to IBM Tivoli Netcool Impact 7.1.0 FP28 |
Workarounds and Mitigations
None
Affected configurations
Related
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
81.1%