Security Bulletin: Dashboard of IBM Sterling B2B Integrator is vulnerable to session mismanagment (CVE-2022-22371)

Summary

IBM Sterling B2B Integrator has addressed the session mismangement vulnerability in Dashboard.

Vulnerability Details

CVEID:CVE-2022-22371
**DESCRIPTION:**IBM Sterling B2B Integrator Standard Edition does not invalidate session after a password change which could allow an authenticated user to impersonate another user on the system.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/221195 for the current score.
CVSS Vector: (CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

Remediation/Fixes

IT41026

| Apply 6.1.0.6, 6.1.1.2 or 6.1.2.1

The version 6.0.3.7, 6.1.0.6, 6.1.1.2 and 6.1.2.1 are available on Fix Central.

The container version of 6.1.2.1 is available in IBM Entitled Registry with following tags.

• cp.icr.io/cp/ibm-b2bi/b2bi:6.1.2.1 for IBM Sterling B2B Integrator
• cp.icr.io/cp/ibm-sfg/sfg:6.1.2.1 for IBM Sterling File Gateway

Workarounds and Mitigations

None