Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM4DFEA3D138751E33BC920EA566E88D0868DB78A0F4EE62F889E1B8BFB34A0E13
HistoryOct 06, 2022 - 4:45 a.m.

Security Bulletin: A security vulnerability has been identified in IBM WebSphere Application Server Liberty shipped with IBM Business Automation Workflow (CVE-2022-22476)

2022-10-0604:45:03
www.ibm.com
18
ibm
websphere
application server
liberty
business automation workflow
vulnerability
cve-2022-22476
containers
traditional
remediation
identity spoofing

CVSS2

6

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

39.9%

JSON

Summary

WebSphere Application Server Liberty is shipped as part of IBM Business Automation Workflow containers and as part of the optional components Process Federation Server (since 8.5.6), and User Management Service (since 18.0.0.1) in IBM Business Automation Workflow traditional. Information about a security vulnerability affecting IBM WebSphere Application Server Liberty have been published in a security bulletin.

Vulnerability Details

Refer to the security bulletin(s) listed in the Remediation/Fixes section

Affected Products and Versions

Affected Product(s) Version(s) Status Note
IBM Business Automation Workflow containers V22.0.1 - V22.0.1-IF001
V21.0.2 - V21.0.3-IF011
V20.0.0.1 - V20.0.0.2 affected
IBM Business Automation Workflow traditional V22.0.1
V21.0.1 - V21.0.3
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3
V18.0.0.0 - V18.0.0.2 affected Cumulative Fixes cannot automatically install interim fixes for the base Application Server. It is important to follow the complete installation instructions and manually ensure that recommended security fixes are installed.

For earlier and unsupported versions of the products, IBM recommends upgrading to a fixed, supported version of the product.

Remediation/Fixes

Please consult the security bulletin: IBM WebSphere Application Server Liberty is vulnerable to Identity Spoofing (CVE-2022-22476) for vulnerability details and information about fixes.

Affected Product(s) Version(s) Remediation / Fix
IBM Business Automation Workflow containers V22.0.1 - V22.0.1-IF001 Apply 22.0.1-IF002 or
upgrade to a later version than V22.0.1 if available
IBM Business Automation Workflow containers V21.0.3 - V21.0.3-IF011 Apply 21.0.3-IF012 or
upgrade to a later version than V22.0.1 if available
IBM Business Automation Workflow containers V21.0.1 - V21.0.2
V20.0.0.1 - V20.0.0.2 Upgrade to V21.0.3 and apply 21.0.3-IF012 or
upgrade to V22.0.1 and apply 22.0.1-IF002 or
upgrade to a later version than V22.0.1 if available
IBM Business Automation Workflow traditional V22.0.1
V21.0.1 - V21.0.3
V20.0.0.1 - V20.0.0.2
V19.0.0.1 - V19.0.0.3
V18.0.0.0 - V18.0.0.2 Follow the instructions from IBM WebSphere Application Server Liberty is vulnerable to Identity Spoofing (CVE-2022-22476) .

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmbusiness_automation_workflowMatch18.0.0.0
OR
ibmbusiness_automation_workflowMatch18.0.0.1
OR
ibmbusiness_automation_workflowMatch18.0.0.2
OR
ibmbusiness_automation_workflowMatch19.0.0.1
OR
ibmbusiness_automation_workflowMatch19.0.0.2
OR
ibmbusiness_automation_workflowMatch19.0.0.3
OR
ibmbusiness_automation_workflowMatch20.0.0.1
OR
ibmbusiness_automation_workflowMatch20.0.0.2
OR
ibmbusiness_automation_workflowMatch21.0.2
OR
ibmbusiness_automation_workflowMatch21.0.3
VendorProductVersionCPE
ibmbusiness_automation_workflow18.0.0.0cpe:2.3:a:ibm:business_automation_workflow:18.0.0.0:*:*:*:*:*:*:*
ibmbusiness_automation_workflow18.0.0.1cpe:2.3:a:ibm:business_automation_workflow:18.0.0.1:*:*:*:*:*:*:*
ibmbusiness_automation_workflow18.0.0.2cpe:2.3:a:ibm:business_automation_workflow:18.0.0.2:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.1cpe:2.3:a:ibm:business_automation_workflow:19.0.0.1:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.2cpe:2.3:a:ibm:business_automation_workflow:19.0.0.2:*:*:*:*:*:*:*
ibmbusiness_automation_workflow19.0.0.3cpe:2.3:a:ibm:business_automation_workflow:19.0.0.3:*:*:*:*:*:*:*
ibmbusiness_automation_workflow20.0.0.1cpe:2.3:a:ibm:business_automation_workflow:20.0.0.1:*:*:*:*:*:*:*
ibmbusiness_automation_workflow20.0.0.2cpe:2.3:a:ibm:business_automation_workflow:20.0.0.2:*:*:*:*:*:*:*
ibmbusiness_automation_workflow21.0.2cpe:2.3:a:ibm:business_automation_workflow:21.0.2:*:*:*:*:*:*:*
ibmbusiness_automation_workflow21.0.3cpe:2.3:a:ibm:business_automation_workflow:21.0.3:*:*:*:*:*:*:*

Related

ibm 55
nvd 1
cve 1
prion 1
nessus 1
osv 1
cvelist 1
ibm
ibm
Security Bulletin: The IBM® Engineering Lifecycle Engineering product using IBM WebSphere Application Server Liberty is vulnerable to Identity Spoofing (CVE-2022-22476)
2023-09-20 12:42:21
Security Bulletin: IBM CICS TX Advanced is vulnerable to identity spoofing due to IBM WebSphere Application Server Liberty (CVE-2022-22476)
2023-02-14 21:04:36
Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty and Open Liberty 17.0.0.3 through 22.0.0.5 affects CICS Transaction Gateway
2023-02-09 10:24:31
nvd
nvd
CVE-2022-22476
2022-07-08 18:15:09
cve
cve
CVE-2022-22476
2022-07-08 18:15:09
prion
prion
Design/Logic Flaw
2022-07-08 18:15:00
nessus
nessus
IBM WebSphere Application Server Liberty 17.0.0.3 <= 22.0.0.7 Identity Spoofing (6602015)
2022-08-03 00:00:00
osv
osv
CVE-2022-22476
2022-07-08 18:15:09
cvelist
cvelist
CVE-2022-22476
2022-07-08 17:45:25

CVSS2

6

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

39.9%

JSON
Related for 4DFEA3D138751E33BC920EA566E88D0868DB78A0F4EE62F889E1B8BFB34A0E13
ibm55nvd1cve1prion1nessus1osv1cvelist1